Redshift clusters should use enhanced VPC routing

How to fix it

Set EnhancedVpcRouting to true on the cluster, so COPY and UNLOAD traffic is forced through your VPC where security groups, endpoint policies and flow logs govern it. Build the network path first, because traffic with nowhere to go simply fails: an S3 gateway endpoint for same-Region buckets, a NAT gateway for anything else, and interface endpoints if the cluster signs in through IAM Identity Center. Redshift restarts the cluster automatically when this changes.

In the console

Redshift → Clusters → the cluster → Properties → Network and security settings → Edit → Enhanced VPC routing

With the AWS CLI

aws redshift modify-cluster --cluster-identifier <cluster-id> --enhanced-vpc-routing --region <region>

With Terraform

resource "aws_redshift_cluster" "this" {
  cluster_identifier   = var.cluster_identifier
  node_type            = var.node_type
  enhanced_vpc_routing = true
}