Question 1

Is allow_version_upgrade enforced for AWS Well-Architected Framework v10?

Accepted Answer

Yes, This control checks whether automatic major version upgrades are enabled for the AWS Redshift cluster.

Question 2

Is cloudwatch_log_group_kms_key_id enforced for AWS Well-Architected Framework v10?

Accepted Answer

Yes, To help protect sensitive data at rest, ensure encryption is enabled for your AWS CloudWatch Log Group.

Question 3

Is cloudwatch_log_group_retention_in_days enforced for AWS Well-Architected Framework v10?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 4

Is cluster_identifier enforced for AWS Well-Architected Framework v10?

Accepted Answer

Yes, This control ensures if redshift clusters are logging audits to a specific bucket. The rule is no compliant if audit logging is not enabled for a redshift cluster or if the 'bucketNames' parameter is provided but the audit logging destination does not match.

Question 5

Is encrypted enforced for AWS Well-Architected Framework v10?

Accepted Answer

Yes, To protect data at rest, ensure that encryption is enabled for your AWS Redshift clusters. You must also ensure that required configurations are deployed on AWS Redshift clusters. The audit logging should be enabled to provide information about connections and user activities in the database.

Question 6

Is publicly_accessible enforced for AWS Well-Architected Framework v10?

Accepted Answer

Yes, Manage access to resources in the AWS Cloud by ensuring that AWS Redshift clusters are not public.

AWS Redshift Terraform module

Terraform Module Source