Amazon Redshift clusters should prohibit public access

How to fix it

Have PubliclyAccessible set to false on the Redshift cluster, so it has no internet-facing DNS name and no public IP address. The change takes effect at once and does not restart the cluster, but it withdraws the elastic IP address that public accessibility created, so every client that was reaching the cluster over that address stops connecting unless it can arrive inside the VPC instead, through a VPN, Direct Connect, VPC peering or a Redshift-managed VPC endpoint. Confirm what connects from outside the VPC first: BI tools, on-premises loaders and cross-account clients are the usual ones. The old address is not held for you either, so turning public access back on later takes a fresh elastic IP unless one is supplied in the same operation. This check reads only the PubliclyAccessible flag, so it says nothing about who may reach the cluster from inside the VPC: narrowing the security group rules does not clear this finding, and clearing this one does not clear a security-group finding on the same cluster. A cluster whose collected configuration carries no PubliclyAccessible field fails too: DescribeClusters always returns it for a VPC cluster, so its absence means the reading is wrong rather than that the cluster is private. If this finding will not clear on a cluster already set to false, check that the scanning role can read it.

In the console

Redshift → Clusters → the cluster → Actions → Publicly accessible (also shown at Properties → Network and security settings)

With the AWS CLI

aws redshift modify-cluster --cluster-identifier <cluster-id> --no-publicly-accessible --region <region>

With Terraform

resource "aws_redshift_cluster" "this" {
  cluster_identifier  = var.cluster_identifier
  node_type           = var.node_type
  publicly_accessible = false
}