Connections to Amazon Redshift clusters should be encrypted in transit

How to fix it

Set require_ssl to true in the parameter group attached to the cluster. A default parameter group cannot be edited, so this usually means creating a custom group and associating it with the cluster, and the cluster has to restart before either change takes effect. Clients that connect without TLS will stop connecting, so check drivers and connection strings first.

In the console

Redshift → Configurations → Workload management → the cluster's parameter group → Parameters → require_ssl

With the AWS CLI

aws redshift modify-cluster-parameter-group --parameter-group-name <parameter-group-name> --parameters ParameterName=require_ssl,ParameterValue=true --region <region>

With Terraform

resource "aws_redshift_parameter_group" "this" {
  name   = var.parameter_group_name
  family = "redshift-2.0"

  parameter {
    name  = "require_ssl"
    value = "true"
  }
}