Amazon Redshift clusters should not use the default Admin username

How to fix it

Set at creation: fixing it means replacing the resource.

Create a replacement cluster with an admin username an attacker would not guess, move the data across with UNLOAD and COPY, then delete the old cluster. The username is fixed at creation: no modify changes it, and a snapshot restore inherits the old name without reporting an error. The check flags awsuser, admin, root, sa, oracle and postgres, which is broader than AWS's own control.

In the console

Redshift → Create cluster → Database configurations → Admin user name, which is fixed once the cluster exists

With Terraform

resource "aws_redshift_cluster" "this" {
  cluster_identifier = var.cluster_identifier
  node_type          = var.node_type
  master_username    = var.master_username
}