Amazon Redshift Security Review
Amazon Redshift’s data is reachable through database roles, the IAM roles attached to the cluster, and any datashare open to another account. We test all three, alongside network exposure and encryption. CREST-certified testers, fixed price from £3,280 for a 2-day single-cluster scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Amazon Redshift’s syntax for attaching a row-level security or dynamic data masking policy accepts a database user, a role, or PUBLIC. PUBLIC means the policy applies to everyone who queries that table or column unless a narrower attachment overrides it.
Why Amazon Redshift security comes down to database roles, IAM roles and who a datashare reaches
Access to an Amazon Redshift cluster starts at the database, not the AWS account. Redshift’s own documentation on database users states that a user can only be created or dropped by a database superuser, and its guidance on superusers confirms the admin user created when the cluster was launched holds that status by default. Role-based access control lets you assign more granular permissions instead of relying on superuser status for everyday work, but a role only helps if the superuser and group grants sitting alongside it are removed, not just added to. Where a user authenticates through IAM rather than a database password, Amazon Redshift’s GetClusterCredentials operation generates temporary database credentials from an IAM policy, so the permissions that policy grants matter as much as the database role the credentials map to.
The cluster’s reach outward is controlled separately again. Amazon Redshift’s guide to authorising COPY and UNLOAD with IAM roles calls an attached IAM role the preferred way to let the cluster read or write to Amazon S3, and the same type of role is what Redshift Spectrum associates with the cluster before an external schema can query data sitting in S3, including, per Amazon’s own IAM policies for Spectrum documentation, chained roles and cross-account S3 permissions. Network exposure follows its own default: Amazon states that clusters are private by default, gaining a public elastic IP address only once you configure one to be publicly accessible, and separately, enhanced VPC routing forces COPY and UNLOAD traffic through the VPC rather than the public internet once it is switched on. Encryption sits underneath all of it: Redshift’s database encryption documentation confirms a cluster is encrypted by default, but also that an encrypted cluster can be switched back to unencrypted by changing a single setting.
The features that decide who sees which rows sit closer to the query itself. Amazon’s data sharing documentation confirms you can share live database objects, for both reads and writes, from one AWS account to another without copying the data, and its reference for ATTACH RLS POLICY and ATTACH MASKING POLICY shows both attach to a named user, a role, or PUBLIC. Audit logging is not automatic either: Amazon states plainly that audit logging is not turned on by default, and that the user activity log needs its own setting even once connection and user logging are enabled. We confirm whether your deployment is a provisioned Redshift cluster or a Redshift Serverless workgroup during scoping, since Serverless organises resources into workgroups and namespaces rather than a single cluster, and test to that boundary. For the equivalent review on another cloud warehouse, see our Snowflake security review, and our database security review for the wider family this scope sits within.
SCOPE
What we review in a Redshift warehouse
Database Users, Groups and Roles
Amazon Redshift’s own documentation states that a user can only be created or dropped by a database superuser, and that a superuser holds the same permissions as a database owner across every database on the cluster, with the admin user created at launch a superuser by default. We map every user, group and role against who actually needs superuser or elevated access, and check whether roles added for role-based access control have narrowed that access or simply sit alongside the older grants.
IAM Authentication and Database Credentials
Amazon Redshift’s GetClusterCredentials operation generates temporary database user credentials from an IAM permissions policy instead of a stored password, and a SAML 2.0 identity provider can be configured through an IAM role to let federated users log on the same way. We test what an IAM policy actually authorises a federated user or application to do once it reaches the database, not just whether IAM authentication is switched on.
IAM Roles for COPY and UNLOAD to Amazon S3
Amazon Redshift’s documentation calls specifying an IAM role the preferred method of supplying credentials for COPY, UNLOAD and CREATE EXTERNAL SCHEMA, and those credentials authorise the cluster to read or write directly to an S3 bucket on the role’s behalf. We test what every IAM role associated with the cluster is actually scoped to reach in S3, not just whether COPY and UNLOAD work.
Redshift Spectrum and External Schemas
Setting up Redshift Spectrum means creating an IAM role and associating it with the cluster before an external schema and external table can point at data in Amazon S3, and Amazon’s own guidance for Spectrum covers chaining IAM roles and granting cross-account S3 permissions for exactly this. We test whether an external schema’s role grants Spectrum only the S3 and AWS Glue Data Catalog access the query needs, including any cross-account permission left in place.
Network Access, Public Accessibility and Security Groups
Amazon Redshift documents clusters as private by default, with a provisioned cluster or Serverless workgroup only gaining a public, internet-reachable elastic IP address once you explicitly configure it to be publicly accessible, and inbound access then granted through a VPC security group. We test the cluster’s actual public accessibility setting and security group rules against what the network design says should be reachable, on both provisioned and Serverless.
Enhanced VPC Routing
With enhanced VPC routing switched on, Amazon Redshift forces all COPY and UNLOAD traffic between the cluster and its data repositories through the VPC, so standard controls such as security groups, network ACLs, VPC endpoints and endpoint policies apply to that traffic instead of it leaving over the public internet. We test whether enhanced VPC routing is actually enabled and whether the VPC controls it depends on are configured to restrict that traffic, not just present.
Encryption at Rest with AWS KMS
Amazon Redshift’s documentation states that a database is encrypted by default to protect data at rest, using either an AWS-owned key or a customer managed AWS KMS key, and that an encrypted cluster can also be modified back to unencrypted by changing the Encrypt database option. We test which key is actually protecting the cluster and its snapshots, and whether encryption has ever been switched off since the cluster was created.
Data Sharing Across Accounts
Amazon Redshift’s data sharing documentation confirms you can share database objects, for both reads and writes, across different clusters or Redshift Serverless workgroups within the same AWS account or from one account to another, with the data staying live rather than copied. We test every active datashare against who it was actually created for, since a share granted for one account or one project does not expire on its own.
Row-Level Security and Dynamic Data Masking
Amazon Redshift’s ATTACH RLS POLICY and ATTACH MASKING POLICY commands both attach to a named user, a role, or PUBLIC, and only a superuser or a role holding sys:secadmin can create or attach either type of policy. We test whether a policy attached to one role has been left off another role that reaches the same table or column, and whether masking policy priority produces the masking your application expects.
UNLOAD Exports and Audit Logging
UNLOAD writes query results to Amazon S3 using server-side encryption, and Amazon Redshift’s own documentation states that audit logging is not turned on by default, and that even once enabled, the user activity log needs its own enable_user_activity_logging setting turned on separately from the connection and user logs. We test what an UNLOAD can actually export, and whether the logging you rely on for evidence would have captured it.
OUR PROCESS
Amazon Redshift Security Review: From Scope to Attestation
Scope and Access
We agree which clusters or Serverless workgroups, IAM roles and datashares are in scope, plus a database user for every privilege tier you want tested and read access to the cluster’s IAM role associations.
Role and IAM Mapping
We map every database user, group, role and attached IAM role against who or what actually needs that level of access, across provisioned clusters and Redshift Serverless workgroups.
Manual Testing
A CREST-certified tester manually tests authentication and role-based access control, IAM roles for COPY, UNLOAD and Spectrum, network exposure, encryption, datashares, row-level security and dynamic data masking, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Redshift pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Amazon Redshift Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Redshift For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Amazon Redshift Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Redshift cluster?
We need at least one authenticated database user for every privilege tier you want tested, from an ordinary user through to a role that can query the cluster’s own user, group and role catalogue. Read access to the IAM roles associated with the cluster, either directly or through the AWS console, speeds up the review, though we can test with database-level access alone.
Will testing touch live data?
We test the databases, schemas and datashares you nominate, working against your actual roles, IAM permissions and query results rather than a copy, so we agree exclusions such as destructive commands or production replica targets before testing starts. We do not export real customer data or run destructive tests without that agreement in writing.
What is out of scope for a single-cluster Redshift review?
We never test Amazon Redshift’s own source code, the underlying AWS infrastructure that hosts your cluster, or AWS’s shared compute and storage layer, and a separately hosted application that happens to query the warehouse is scoped and quoted on its own. We test the database roles, IAM roles, network configuration, encryption, data sharing and masking controls for the cluster or workgroup you nominate.
Do you test Redshift Serverless the same way as a provisioned cluster?
The underlying questions are the same: who can authenticate, what role or IAM permission they hold, and what the network and any datashare actually expose. Redshift Serverless organises resources into workgroups and namespaces rather than a single cluster identifier, and its audit logging can only be sent to Amazon CloudWatch rather than log files, so we confirm your deployment type during scoping and test to that boundary.
Is Redshift Spectrum in scope?
Yes, where you nominate it. We test the IAM role associated with the cluster and the external schema’s permissions against what Spectrum actually needs to reach in Amazon S3 and AWS Glue, though the underlying S3 bucket’s own bucket policy and any other service reading from it is scoped separately unless you nominate that too.
Does AWS have a policy on penetration testing Amazon Redshift?
AWS’s customer penetration testing policy lists the services you can test without prior approval, including Amazon EC2, RDS, Aurora, API Gateway and Lambda, and Amazon Redshift is not one of them. Our review tests your cluster’s database roles, IAM configuration, network settings and data controls, which is your responsibility under the AWS shared responsibility model, rather than AWS’s underlying Redshift service, so it falls outside what that policy governs. If a scope ever needs to reach infrastructure AWS’s policy does cover, we confirm AWS’s current approval process during scoping.
How long does a Redshift security review take?
A single cluster or Serverless workgroup, with a limited number of roles, IAM associations and datashares, sits in our 2-day single-cluster scope, with a report typically landing around 5 working days after kickoff. More roles, multiple datashares, or a mix of provisioned and Serverless deployments moves into a larger scope with more testing days.
Are your testers CREST certified?
Yes. Every Redshift engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Redshift review
Amazon Redshift’s data is reachable through database roles, the IAM roles attached to the cluster, and any datashare open to another account. We test all three, alongside network exposure and encryption. CREST-certified testers, fixed price from £3,280 for a 2-day single-cluster scope, quoted within 24 hours.
