Terraform AWS Redshift
Redshift clusters or serverless workgroups with VPC networking, encryption, audit logging, snapshot settings, parameter groups, enhanced VPC routing, and controlled access.
Quick start
module "redshift" {
source = "pcidss.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
# ... your arguments here
}module "redshift" {
source = "nist80053.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
# ... your arguments here
}module "redshift" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
# ... your arguments here
}module "redshift" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
# ... your arguments here
}module "redshift" {
source = "iso27001.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
# ... your arguments here
}module "redshift" {
source = "nistcsf.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
# ... your arguments here
}module "redshift" {
source = "ffiec.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
# ... your arguments here
}module "redshift" {
source = "hipaa.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
# ... your arguments here
}This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.
Migration from upstream
Already using terraform-aws-modules? Change only the source URL:
module "redshift" {
source = "terraform-aws-modules/redshift/aws"
version = "~> 7.1"
}module "redshift" {
source = "soc2.compliance.tf/terraform-aws-modules/redshift/aws"
version = "~> 7.1"
}Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.
Reversibility
No lock-in. Switch back by reverting the source URL:
module "redshift" {
source = "terraform-aws-modules/redshift/aws"
}Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.
Controls enforced
Up to 17 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.
Mapped compliance frameworks
| Clause | Controls from this module |
|---|---|
| 1.2.5: Network security controls (NSCs) are configured and maintained. | |
| 1.3.1: Network access to and from the cardholder data environment is restricted. | |
| 1.3.2: Network access to and from the cardholder data environment is restricted. | |
| 1.4.1: Network connections between trusted and untrusted networks are controlled. | |
| 1.4.2: Network connections between trusted and untrusted networks are controlled. | |
| 1.4.4: System components that store cardholder data are not directly accessible from untrusted networks | |
| 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.3.1: Audit logs are protected from destruction and unauthorized modifications. | |
| 10.3.2: Audit logs are protected from destruction and unauthorized modifications. | |
| 10.3.3: Audit log files, including those for externalfacing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify | |
| 10.3.4: File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts | |
| 10.5.1: Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis | |
| 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. | |
| 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons | |
| 2.2.7: System components are configured and managed securely. | |
| 3.2.1: Storage of account data is kept to a minimum. | |
| 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.3.2: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.3.3: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.5.1: Primary account number (PAN) is secured wherever it is stored. | |
| 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained | |
| 4.2.1: PAN is protected with strong cryptography during transmission. | |
| 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. | |
| 6.3.3: All system components are protected from known vulnerabilities by installing applicable security patches/updates | |
| 6.3.3: Security vulnerabilities are identified and addressed. | |
| 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components | |
| A1.2.3: Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities |
| Clause | Controls from this module |
|---|---|
| AC-16(b) | |
| AC-2(4) Automated Audit Actions | |
| AC-3(1) Restricted Access To Privileged Functions | |
| AC-3(10) Audited Override Of Access Control Mechanisms | |
| AC-4(26) Audit Filtering Actions | |
| AC-6(9) | |
| AU-11(1) Long-Term Retrieval Capability | |
| AU-12(1) System-Wide And Time-Correlated Audit Trial | |
| AU-12(2) Standardized Formats | |
| AU-12(3) Changes By Authorized Individuals | |
| AU-12(4) Query Parameter Audits Of Personally Identifiable Information | |
| AU-12(a) | |
| AU-12(c) | |
| AU-14(3) Remote Viewing And Listening | |
| AU-14(a) | |
| AU-14(b) | |
| AU-2(b) | |
| AU-3(a) | |
| AU-3(b) | |
| AU-3(c) | |
| AU-3(d) | |
| AU-3(e) | |
| AU-3(f) | |
| AU-6(3) Correlate Audit Record Repositories | |
| AU-6(4) Central Review And Analysis | |
| AU-6(6) Correletion With Physical Monitoring | |
| AU-6(9) Correletion With From Nontechnical Sources | |
| AU-8(b) | |
| AU-9(3) Cryptographic Protection | |
| Audit Record Retention (AU-11) | |
| CA-7(b) | |
| CM-2(b) | |
| CM-3(3) Automated Change Implementation | |
| CM-5(1)(b) | |
| CP-9(a) | |
| CP-9(b) | |
| CP-9(c) | |
| CP-9(d) | |
| Continuous Monitoring Strategy (PM-31) | |
| IA-3(3)(b) | |
| Information Management and Retention (SI-12) | |
| MA-4(1)(a) | |
| Non-Repudiation (AU-10) | |
| PM-14(a)(1) | |
| PM-14(b) | |
| PM-21(b) | |
| SC-13(a) | |
| SC-28(1): Cryptographic Protection | |
| SC-28(2) Offline Storage | |
| SC-5(2) Capacity, Bandwidth, And Redundancy | |
| SC-7(13): Isolation Of Security Tools, Mechanisms, And Support Components | |
| SC-7(9)(b) | |
| SC-7: Boundary Protection | |
| SC-8(3) Cryptographic Protection For Message Externals | |
| SC-8(4) Conceal Or Ramdomize Communications | |
| SI-1(1)(c) | |
| SI-10(1)(c) | |
| SI-19(4) Removal, Masking, Encryption, Hashing, Or Replacement Of Direct Identifiers | |
| SI-2(2) Automated Flaw Remediation Status | |
| SI-2(5): Automatic Software And Firmware Updates | |
| SI-2(c) | |
| SI-2(d) | |
| SI-3(8)(b) | |
| SI-4(17) Integrated Situational Awareness | |
| SI-4(2) Automated Tools For Real-Time Analysis | |
| SI-4(20) Privileged Users | |
| SI-7(8) Auditing Capability For Significant Events | |
| Thin Nodes (SC-25) |
| Clause | Controls from this module |
|---|---|
| 11.10(c) Protection of records to enable their accurate and ready retrieval throughout the records retention period | |
| 11.10(d) Limiting system access to authorized individuals | |
| 11.10(e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records | |
| 11.10(g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand | |
| 11.30 Controls for open systems |
| Clause | Controls from this module |
|---|---|
| AC-2(4) Automated Audit Actions | |
| AC-2(g) | |
| AC-4: Information Flow Enforcement | |
| AU-12(a)(c) | |
| AU-2(a)(d) | |
| AU-6(1)(3) | |
| Audit Record Retention (AU-11) | |
| CA-7(a)(b) | |
| Content of Audit Records (AU-3) | |
| Information Handling and Retention (SI-12) | |
| Protection of Audit Information (AU-9) | |
| Protection of Information at Rest (SC-28) | |
| SC-7: Boundary Protection | |
| SI-4(16) Correlate Monitoring Information | |
| SI-4(2) Automated Tools For Real-Time Analysis | |
| SI-4(4) Inbound and Outbound Communications Traffic | |
| SI-4(5) System-Generated Alerts | |
| Session Authenticity (SC-23) |
| Clause | Controls from this module |
|---|---|
| A.8.12 Data leakage prevention | |
| A.8.14 Redundancy of information processing facilities | |
| A.8.15 Logging | |
| A.8.16 Monitoring activities | |
| A.8.20 Network security | |
| A.8.21 Security of network services | |
| A.8.22 Segregation of networks | |
| A.8.24 Use of cryptography | |
| A.8.3 Information access restriction |
| Clause | Controls from this module |
|---|---|
| ID.BE-5 | |
| PR.DS-02 | |
| PR.DS-1 | |
| PR.DS-4 | |
| PR.DS-5 | |
| PR.IR-03 | |
| PR.IR-04 | |
| PR.PS-02 | |
| RC.RP-06 |
| Clause | Controls from this module |
|---|---|
| D1.RM.Rm.B.1 | |
| D2.MA.Ma.B.1 | |
| D2.MA.Ma.B.2 | |
| D3.CC.PM.B.1 | |
| D3.CC.PM.B.3 | |
| D3.DC.An.B.4 | |
| D3.DC.Ev.B.1 | |
| D3.PC.Am.B.12 | |
| D3.PC.Am.B.15 | |
| D3.PC.Im.B.1 | |
| D5.DR.De.B.3 |
| Clause | Controls from this module |
|---|---|
| 164.308(a)(1)(ii)(B) Risk Management | |
| 164.308(a)(1)(ii)(D): Administrative Safeguards | |
| 164.308(a)(3)(ii)(A) Authorization and/or supervision | |
| 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions | |
| 164.312(a)(2)(iv) Encryption and decryption | |
| 164.312(b) Audit controls | |
| 164.312(e)(1) Transmission security | |
| 164.312(e)(2)(ii) Encryption | |
| 164.314(b)(2)(iv): Organizational Requirements |
Framework coverage
Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.
17 controls enforced with a source URL change.