krgift.blogg.se - Amazon redshift wiki

AMAZON REDSHIFT WIKI HOW TO
AMAZON REDSHIFT WIKI DRIVERS

Amazon Redshift SQL scripts can contain commands such as bulk loading using the COPY statement or data transformation using DDL & DML SQL statements.

AMAZON REDSHIFT WIKI HOW TO

This project demonstrates how to use a AWS Glue Python Shell Job to connect to your Amazon Redshift cluster and execute a SQL script stored in Amazon S3. Redshift has a service-linked role associated with it, but the role configuration cannot be altered by AWS users.Execute Amazon Redshift Commands using AWS Glue.aws redshift describe-clusters -cluster-identifier, look for AllowVersionUpgrade parameter.The S3 bucket that these logs are written to should have the standard S3 controls applied, as detailed in the S3 guide."ParameterName": "enable_user_activity_logging" should be set to true.Ensure user activity logging is enabled.Result should include "LoggingEnabled": true.aws redshift describe-logging-status -cluster-identifier.Ensure cluster audit logging is enabled.Either log to S3 buckets, or pull logging data regularly from the system logging tables inside the cluster, per.aws redshift describe-clusters -cluster-identifier, look for AutomatedSnapshotRetentionPeriod parameter.Ensure automated snapshots are retained for a reasonable period.

"ParameterName": "require_SSL" should be set to true.aws redshift describe-cluster-parameters -parameter-group-name to get the parameter group contents.aws redshift describe-clusters -cluster-identifier to get cluster parameter group.The require_SSL parameter must be set to true in the parameter group that is associated with the cluster for SSL to be enforced.TLS is enabled by default, but not enforced.aws redshift describe-clusters -cluster-identifier, look for Encrypted parameter.for details of how the cluster-level server side encryption works.Server-side encryption preferable in most use cases due to lower overhead, this uses KMS under the hood and encrypts/decrypts transparently.These VPC endpoints should have policies configured to block access to all Redshift clusters to which access is not required, to block data exfiltration to attacker-controlled clusters.aws redshift describe-clusters -cluster-identifier, PubliclyAccessible should be falseĮnsure a VPC Endpoint for Redshift is deployed in any VPCs accessing the service.Using Column-Level Access Control to restrict which columns users can accessĮnsure the Redshift cluster has a security group configured that restricts access to only those IP ranges or EC2 security groups that need access.Implementing views to abstract or hide some data or structure from some users and applications.Implementing user groups within Redshift to restrict who can access what schema.This depends on use case, but the following should be considered: aws redshift create-cluster -master-username to specify a different master user on creation.Default master user username is awsuser.

Master user should be renamed when cluster is created.

Ensure any roles assigned to the cluster only grant permissions to the specific buckets, functions etc that are required for the cluster to function.

IAM roles assigned to Redshift can be used to access S3, Athena, Glue, and Lambda.

Ensure the IAM roles that have access to the cluster are supposed to, and that they're configured with sensible permissions according to the principle of least privilege.

AMAZON REDSHIFT WIKI DRIVERS

IAM-backed authentication should be used for Redshift users, either by using the Redshift JDBC or ODBC drivers which handle it natively, or by making use of the GetClusterCredentials API call to request database credentials associated with the current IAM user or role.A cloud "data warehouse" - large scale SQL-based data store designed for holding terabytes or petabytes of data.