rage.fail

aws-redshift-cluster-publicly-accessible

explicit aws emits ExposedToInternet

match (record)

{ "field": "PubliclyAccessible", "resource_type": "AWS::Redshift::Cluster" }

where

PubliclyAccessible == true

emit

source type	`Data`
target type	`AnonymousIdentity`
source	`<Redshift Cluster (DataWarehouse node)>`
target	`<AnonymousIdentity>`
conditions	`network_reachability`

Narrative

{cluster.name} has PubliclyAccessible=true. The cluster endpoint resolves to a public IP. Reachability from the internet also requires the VPC security group to permit inbound TCP port 5439; confirm SG rules before marking ACTIVE (derived rule aws-redshift-public-cluster performs the SG check).

Raw rule rules/explicit/aws-redshift.yaml

id: aws-redshift-cluster-publicly-accessible
emits: ExposedToInternet
match_record:
  resource_type: AWS::Redshift::Cluster
  field: PubliclyAccessible
where:
- PubliclyAccessible == true
emit:
  source_type: Data
  target_type: AnonymousIdentity
  source: <Redshift Cluster (DataWarehouse node)>
  target: <AnonymousIdentity>
  api_source: redshift:DescribeClusters
  evidence_field: PubliclyAccessible
  state: CONDITIONAL
  conditions:
  - network_reachability
  narrative: '{cluster.name} has PubliclyAccessible=true. The cluster endpoint resolves to a public IP.
    Reachability from the internet also requires the VPC security group to permit inbound TCP port 5439;
    confirm SG rules before marking ACTIVE (derived rule aws-redshift-public-cluster performs the SG check).'