Redshift cluster is not encrypted at rest

Severity: High
Service: Redshift
Check ID: REDSHIFT_NOT_ENCRYPTED

What this check finds

Unencrypted Redshift clusters expose data warehousing data if storage media is compromised. Encryption at rest is a baseline requirement for PCI-DSS, HIPAA, and SOC 2 compliance.

Passing looks like: Redshift encrypted at rest.

How to fix it

Encryption cannot be enabled on an existing unencrypted cluster without a snapshot restore. Take a snapshot, then restore it with encryption enabled:

AWS console

Redshift → Clusters → Actions → Create snapshot → Restore from snapshot → Enable encryption. Alternatively: aws redshift restore-from-cluster-snapshot with --encrypted flag.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Redshift cluster is not encrypted at rest
Framework	Controls
PCI-DSS v4.0.1	3.5 Primary account number (PAN) is secured wherever it is stored
HIPAA Security Rule	164.312(a)(2)(iv) Encryption and Decryption of ePHI at Rest
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management C1.1 Encryption of Confidential Data
NIST SP 800-53 Rev5 (Moderate)	SC-13 Cryptographic Protection SC-28 Protection of Information at Rest
NIST Cybersecurity Framework 2.0	PR.DS-01 Data-at-rest is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Redshift checks

All Redshift checks