Redshift Cluster Version Upgrade Disabled

Risk Level: Low

Description

This plugin ensures that version upgrade is enabled for Redshift clusters to automatically allow upgrades during the maintenance time interval.  Redshift clusters should be configured to run the latest service software as with the updates, certain bugs and security vulnerabilities are fixed.

About the Service

Amazon RedShift: Amazon RedShift is a data warehouse with fast and secure data analyzing features. It is a powerful and robust service powered by Amazon to run SQL queries and even deploy ML (Machine Learning) models on the data. For additional monitoring benefits, it also provides access to real time operational analytics.

Impact

Running clusters on outdated software versions can have a serious impact on the security. Updated versions have all the previous explored security vulnerabilities fixed. If the cluster still runs on older versions, the attacker can take advantage of this vulnerability.

Steps to Reproduce

Using AWS Console-

1. Log In to your AWS Console.
2. Open the Amazon RedShift Console. You can use this link (https://console.aws.amazon.com/redshiftv2/) to navigate directly if already logged in. 
3. From the left navigation pane, click on Clusters.
   
4. A list of clusters will be displayed. Select the cluster you want to examine by clicking on it’s Cluster Name.
5. Move to the Maintenance tab.
   
6. In the Maintenance detail, check the value of “Allow version upgrade”. If it is set to “No”, the vulnerability exists. 
7. Repeat steps for all the clusters you wish to examine.

Steps for Remediation

1. Configure the AWS CLI with your account credentials.
2. Run the modify-cluster command which will remove the vulnerable statement.
   
   aws redshift modify-cluster
   --region <region_name>
   --cluster-identifier <cluster_name>
   --allow-version-upgrade
3. Repeat the steps for all the vulnerable Redshift clusters.