Redshift security groups should allow ingress on the cluster port only from restricted origins

How to fix it

Leave no ingress rule, on any security group attached to the cluster, that reaches the cluster's own port from 0.0.0.0/0 or ::/0. Three rule shapes reach it and all three fail: an exact rule on that port, a port range that contains it, and a rule carrying no ports at all, which is how an all-traffic rule is stored. No protocol is excluded either, so a UDP or all-traffic rule counts the same as a TCP one. Replace the open rule with the specific CIDR ranges or source security groups that have to reach the cluster rather than deleting it outright, or every client arriving over it stops connecting. The finding names the cluster, not the security group: one open rule on one attached group fails the whole cluster, and a group shared with other resources has to be narrowed for all of them at once, or the cluster moved to a group of its own. Every rule is compared against the cluster's port as it is now, so moving the cluster to a port no open rule covers would clear the finding while leaving the rule in place; that is not the fix, and a range or all-traffic rule would cover the new port anyway. Closing the rule also does not make the cluster private: PubliclyAccessible is a separate setting with its own finding.

In the console

EC2 → Security Groups → the group attached to the cluster (Redshift → Clusters → the cluster → Properties → Network and security settings) → Inbound rules

With the AWS CLI

aws ec2 revoke-security-group-ingress --group-id <group-id> --security-group-rule-ids <rule-id> --region <region>