Description

Detects AWS Redshift clusters that are configured to be publicly accessible in CloudFormation templates. Public Redshift clusters can be accessed from the internet, which increases the attack surface and may lead to unauthorized database access if not properly secured.

Detection Strategy

• Review CloudFormation template files for AWS::Redshift::Cluster resource definitions

• Check if the Redshift cluster resource has PubliclyAccessible property set to true

• Report a security issue if a Redshift cluster is configured to allow public access

Vulnerable code example

Resources:
  MyRedshiftCluster:
    Type: 'AWS::Redshift::Cluster'
    Properties:
      ClusterType: multi-node
      NodeType: ds2.xlarge
      # Unsafe: Hardcoded credentials in infrastructure code
      MasterUsername: admin123...

✅ Secure code example

Resources:
  MyRedshiftCluster:
    Type: 'AWS::Redshift::Cluster'
    Properties:
      ClusterType: multi-node
      NodeType: ds2.xlarge
      # Use SSM Parameter Store for secure credential management
      MasterUsername: '{{resolve:ssm-secure:/redshift/master-username:1}}'...