Redshift clusters should be encrypted at rest

How to fix it

Turn on encryption at rest for the cluster; either an AWS managed or a customer managed KMS key clears this. Redshift migrates the data to new encrypted storage behind a single modify, during which the cluster stays read-only for a time that scales with how much data it holds. Cross-Region snapshot copy has to be turned off before encryption can be changed.

In the console

Redshift → Clusters → the cluster → Properties → Database configurations → Edit → Edit encryption

With the AWS CLI

aws redshift modify-cluster --cluster-identifier <cluster-id> --encrypted --kms-key-id <kms-key-arn> --region <region>

With Terraform

resource "aws_redshift_cluster" "this" {
  cluster_identifier = var.cluster_identifier
  node_type          = var.node_type
  encrypted          = true
}