Redshift clusters should use a custom master username

Documentos > Datadog Security > OOTB Rules > Redshift clusters should use a custom master username

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Description

Confirm Redshift clusters are using a custom master user name, versus the default master user name.

Rationale

Default master user names for publicly accessible clusters can be a backdoor for hacking. While setting a custom master user name alone does not fully protect against attacks, restricting the root account only to privileged users and using additional password measures can add an additional layer of protection.

Remediation

From the console

Follow the Getting information about cluster configuration docs to access your cluster configuration information. If the cluster has a master user name of awsuser, it is the default master user name. Modify the user name to a custom user name in the console.

From the command line

Run describe-clusters with a cluster-identifier to retrieve cluster metadata.
describe-clusters.sh
```
    aws redshift describe-clusters
	    --cluster-identifier cluster-name
    
```

Run create-cluster with the returned cluster metadata to launch a new cluster with the existing metadata and a new master user name.

create-cluster.sh

    aws redshift create-cluster
	    --cluster-identifier old-cluster-identifier
	    --master-username awsmasterusr
        --vpc-security-group-ids id-012a3b4c
        ...
    

Re-run describe-clusters with a custom query filter to retrieve the database cluster endpoint.

describe-clusters.sh

    aws redshift describe-clusters
	    --cluster-identifier new-cluster-identifier
	    --query 'Clusters[*].Endpoint.Address'
    

Reload the old cluster data into the new database cluster with the Unload Copy Utility.
Use the returned new database cluster endpoint URL from step 3 to update your application’s configuration to point to the new cluster endpoint.

Run delete-cluster to delete the old cluster.

delete-cluster.sh

    aws redshift create-cluster
	    --cluster-identifier old-cluster-identifier
	    ...
    