Description

Detects AWS Redshift cluster parameter groups that do not enforce SSL/TLS encryption for client connections. When SSL is not required, data transmitted between clients and the Redshift cluster may be exposed to network-level attacks and unauthorized access.

Detection Strategy

• Check AWS CloudFormation templates for Redshift cluster parameter group resources (AWS::Redshift::ClusterParameterGroup)

• Examine the parameter group configuration properties

• Report a vulnerability if the SSL requirement is explicitly disabled or not enforced in the parameter group settings

Vulnerable code example

Resources:
  MyRedshiftParameterGroup:
    Type: 'AWS::Redshift::ClusterParameterGroup'
    Properties:
      Description: 'Redshift params'
      ParameterGroupFamily: 'redshift-1.0'
      Parameters:
        - ParameterName: 'require_ssl'  # Security issue: Explicitly disabling SSL...

✅ Secure code example

Resources:
  MyRedshiftParameterGroup:
    Type: 'AWS::Redshift::ClusterParameterGroup'
    Properties:
      Description: 'Redshift params'
      ParameterGroupFamily: 'redshift-1.0'
      Parameters:
        - ParameterName: 'require_ssl'  # Security: Enforce SSL/TLS for all connections...