prowler 5.16.1__py3-none-any.whl → 5.17.0__py3-none-any.whl

prowler/providers/aws/services/rds/rds_instance_protected_by_backup_plan/rds_instance_protected_by_backup_plan.metadata.json

@@ -1,31 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "rds_instance_protected_by_backup_plan",
-  "CheckTitle": "Check if RDS instances are protected by a backup plan.",
+  "CheckTitle": "RDS instance is protected by an AWS Backup plan",
   "CheckType": [
-    "Software and Configuration Checks, AWS Security Best Practices"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Effects/Data Destruction"
   ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
   "ResourceType": "AwsRdsDbInstance",
-  "Description": "Check if RDS instances are protected by a backup plan.",
-  "Risk": "Without a backup plan, RDS instances are vulnerable to data loss, accidental deletion, or corruption. This could lead to significant operational disruptions or loss of critical data.",
-  "RelatedUrl": "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html",
+  "ResourceGroup": "database",
+  "Description": "**RDS DB instances** (non-Aurora) are included in an **AWS Backup plan**, indicating scheduled backups and retention are applied to the resource.\n\n*Aurora engines are evaluated separately.*",
+  "Risk": "Without an **AWS Backup plan**, databases lack assured recovery, degrading **availability** and **integrity**. Likely outcomes: accidental deletion, corruption, or malicious wipes with no recent restore point. Expect missed `RPO/RTO`, extended outages, and data inconsistency after incidents.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-26"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws backup create-backup-plan --backup-plan , aws backup tag-resource --resource-arn <rds-instance-arn> --tags Key=backup,Value=true",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-26",
-      "Terraform": ""
+      "CLI": "aws backup create-backup-selection --backup-plan-id <example_backup_plan_id> --backup-selection '{\"SelectionName\":\"<selection_name>\",\"IamRoleArn\":\"<example_role_arn>\",\"Resources\":[\"<rds-instance-arn>\"]}'",
+      "NativeIaC": "```yaml\n# CloudFormation: assign an RDS instance to an AWS Backup plan\nResources:\n  <example_resource_name>:\n    Type: AWS::Backup::BackupSelection\n    Properties:\n      BackupPlanId: <example_backup_plan_id>  # CRITICAL: targets the backup plan to protect the instance\n      BackupSelection:\n        SelectionName: <selection_name>\n        IamRoleArn: <example_role_arn>        # CRITICAL: role AWS Backup uses to back up the resource\n        Resources:\n          - <rds-instance-arn>                # CRITICAL: assigns the RDS instance to the plan\n```",
+      "Other": "1. In the AWS Console, open AWS Backup\n2. Go to Settings > Service opt-in and enable Amazon RDS (if not already)\n3. Go to Backup plans and select an existing plan (or Create backup plan with defaults)\n4. Click Assign resources\n5. Enter a name, select an IAM role, and add the RDS instance (by ARN or resource picker)\n6. Click Assign resources to save",
+      "Terraform": "```hcl\n# Assign an RDS instance to an AWS Backup plan\nresource \"aws_backup_selection\" \"<example_resource_name>\" {\n  name         = \"<selection_name>\"\n  plan_id      = \"<example_backup_plan_id>\"   # CRITICAL: attaches to the backup plan\n  iam_role_arn = \"<example_role_arn>\"         # CRITICAL: role AWS Backup uses\n  resources    = [\"<rds-instance-arn>\"]       # CRITICAL: RDS instance protected by the plan\n}\n```"
     },
     "Recommendation": {
-      "Text": "Create a backup plan for the RDS instance to protect it from data loss, accidental deletion, or corruption.",
-      "Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html"
+      "Text": "Assign all non-Aurora RDS to an **AWS Backup plan** aligned to business `RPO/RTO`. Use **tags** for automatic coverage, define retention and lifecycle, and store backups in **immutable** vaults where possible. Regularly perform restore tests. Enforce **least privilege** and **separation of duties** for backup administration.",
+      "Url": "https://hub.prowler.com/check/rds_instance_protected_by_backup_plan"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "resilience"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/rds/rds_instance_storage_encrypted/rds_instance_storage_encrypted.metadata.json

@@ -1,29 +1,47 @@
 {
   "Provider": "aws",
   "CheckID": "rds_instance_storage_encrypted",
-  "CheckTitle": "Check if RDS instances storage is encrypted.",
-  "CheckType": [],
+  "CheckTitle": "RDS DB instance storage is encrypted at rest",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)",
+    "Software and Configuration Checks/Industry and Regulatory Standards/NIST CSF Controls (USA)",
+    "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS",
+    "Software and Configuration Checks/Industry and Regulatory Standards/ISO 27001 Controls",
+    "Software and Configuration Checks/Industry and Regulatory Standards/HIPAA Controls (USA)",
+    "Software and Configuration Checks/Industry and Regulatory Standards/GDPR Controls (Europe)",
+    "Effects/Data Exposure"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
   "ResourceType": "AwsRdsDbInstance",
-  "Description": "Check if RDS instances storage is encrypted.",
-  "Risk": "If not enabled sensitive information at rest is not protected.",
-  "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html",
+  "ResourceGroup": "database",
+  "Description": "**RDS DB instances** are assessed for **KMS-based encryption at rest** (`StorageEncrypted=true`), covering instance storage and derived artifacts such as snapshots, automated backups, and read replicas.",
+  "Risk": "Without **encryption at rest**, database files, snapshots, and automated backups remain in plaintext. An attacker with access to copied snapshots, compromised backups, or underlying storage can read sensitive data, causing loss of **confidentiality** and enabling large-scale exfiltration.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-encryption-enabled.html",
+    "https://aws.amazon.com/blogs/storage/protecting-amazon-rds-db-instances-encrypted-using-kms-aws-managed-key-with-cross-account-and-cross-region-backups/",
+    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws rds create-db-instance --db-instance-identifier <db_instance_id> --db-instance-class <instance_class> --engine <engine> --storage-encrypted true",
-      "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_4#cloudformation",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-encryption-enabled.html",
-      "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_4#terraform"
+      "CLI": "",
+      "NativeIaC": "```yaml\n# CloudFormation: create an encrypted RDS DB instance\nResources:\n  <example_resource_name>:\n    Type: AWS::RDS::DBInstance\n    Properties:\n      DBInstanceClass: \"<instance_class>\"\n      Engine: \"<engine>\"\n      AllocatedStorage: 20\n      MasterUsername: \"<username>\"\n      MasterUserPassword: \"<password>\"\n      StorageEncrypted: true  # CRITICAL: enables encryption at rest so the instance passes the check\n```",
+      "Other": "1. In the AWS Console, go to RDS > Databases, select the unencrypted DB instance, then choose Actions > Take snapshot.\n2. After the snapshot is available, go to Snapshots, select it, choose Actions > Copy snapshot, enable encryption, and select a KMS key (or aws/rds).\n3. When the encrypted copy is ready, select it and choose Actions > Restore snapshot to create a new (encrypted) DB instance.\n4. Update your application/endpoint to use the new encrypted DB instance.\n5. Decommission the old unencrypted instance after cutover.",
+      "Terraform": "```hcl\n# Terraform: create an encrypted RDS DB instance\nresource \"aws_db_instance\" \"<example_resource_name>\" {\n  engine            = \"<engine>\"\n  instance_class    = \"<instance_class>\"\n  username          = \"<username>\"\n  password          = \"<password>\"\n  allocated_storage = 20\n\n  storage_encrypted = true  # CRITICAL: enables encryption at rest to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable Encryption. Use a CMK where possible. It will provide additional management and privacy benefits.",
-      "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html"
+      "Text": "Enable **encryption at rest** for all RDS instances. Prefer **customer-managed KMS keys** to control rotation and fine-grained access, applying **least privilege** and **defense in depth**. Restrict key usage, monitor key activity, and manage key lifecycle. Migrate unencrypted instances via encrypted snapshot copy and restore.",
+      "Url": "https://hub.prowler.com/check/rds_instance_storage_encrypted"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "encryption"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted.metadata.json

@@ -1,26 +1,34 @@
 {
   "Provider": "aws",
   "CheckID": "rds_instance_transport_encrypted",
-  "CheckTitle": "Check if RDS instances enforce SSL/TLS encryption for client connections (Microsoft SQL Server, PostgreSQL, MySQL, MariaDB, Aurora PostgreSQL, and Aurora MySQL).",
-  "CheckType": [],
+  "CheckTitle": "RDS instance or cluster enforces SSL/TLS encryption for client connections",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices/Network Security"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsRdsDbInstance",
-  "Description": "For SQL Server, PostgreSQL, and Aurora PostgreSQL databases, if the `rds.force_ssl` parameter value is set to 0, SSL/TLS connections are not enforced. For MySQL, Aurora MySQL, and MariaDB databases, if the `require_secure_transport` parameter value is set to OFF, SSL/TLS connections are not enforced. Enforcing SSL/TLS ensures that all client connections to RDS instances are encrypted, protecting sensitive information in transit.",
-  "Risk": "If not enabled, sensitive information in transit is not protected.",
-  "RelatedUrl": "https://aws.amazon.com/premiumsupport/knowledge-center/rds-connect-ssl-connection/",
+  "ResourceGroup": "database",
+  "Description": "**RDS DB instances** and **DB clusters** enforce **SSL/TLS** for client connections via parameter groups. The check looks for `rds.force_ssl=1` (PostgreSQL, SQL Server) or `require_secure_transport` enabled (MySQL-family) and identifies databases where encryption enforcement isn't active.",
+  "Risk": "Without enforced **TLS**, clients can connect or downgrade to plaintext, exposing credentials and queries to interception. Adversaries can perform **MITM**, steal secrets, and tamper traffic, undermining **confidentiality** and **integrity** and enabling reuse of captured database credentials.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://aws.amazon.com/premiumsupport/knowledge-center/rds-connect-ssl-connection/",
+    "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.SSL.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/transport-encryption.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "aws rds modify-db-parameter-group --region <REGION_NAME> --db-parameter-group-name <PARAMETER_GROUP_NAME> --parameters ParameterName='rds.force_ssl',ParameterValue='1',ApplyMethod='pending-reboot'",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/transport-encryption.html",
-      "Terraform": ""
+      "NativeIaC": "```yaml\n# CloudFormation: set required parameter to enforce SSL/TLS\nResources:\n  ExampleDBParameterGroupPostgres:\n    Type: AWS::RDS::DBParameterGroup\n    Properties:\n      Family: <DB_PARAMETER_FAMILY>\n      Description: Enforce SSL/TLS\n      Parameters:\n        rds.force_ssl: \"1\"  # Critical: requires SSL/TLS for PostgreSQL/SQL Server instances\n\n  ExampleDBParameterGroupMySQL:\n    Type: AWS::RDS::DBParameterGroup\n    Properties:\n      Family: <DB_PARAMETER_FAMILY>\n      Description: Enforce SSL/TLS\n      Parameters:\n        require_secure_transport: \"1\"  # Critical: requires SSL/TLS for MySQL/MariaDB instances\n\n  ExampleDBClusterParameterGroupAuroraPostgres:\n    Type: AWS::RDS::DBClusterParameterGroup\n    Properties:\n      Family: <DB_CLUSTER_PARAMETER_FAMILY>\n      Description: Enforce SSL/TLS\n      Parameters:\n        rds.force_ssl: \"1\"  # Critical: requires SSL/TLS for Aurora PostgreSQL clusters\n\n  ExampleDBClusterParameterGroupAuroraMySQL:\n    Type: AWS::RDS::DBClusterParameterGroup\n    Properties:\n      Family: <DB_CLUSTER_PARAMETER_FAMILY>\n      Description: Enforce SSL/TLS\n      Parameters:\n        require_secure_transport: ON  # Critical: requires SSL/TLS for Aurora MySQL clusters\n```",
+      "Other": "1. In the AWS Console, go to RDS > Parameter groups\n2. For DB instances:\n   - Edit the DB parameter group attached to the instance (or create one and attach it)\n   - Set rds.force_ssl = 1 for PostgreSQL/SQL Server, or require_secure_transport = 1 for MySQL/MariaDB\n   - Save. If the parameter is static, reboot the instance\n3. For Aurora clusters:\n   - Edit the DB cluster parameter group attached to the cluster (or create one and attach it)\n   - Set rds.force_ssl = 1 for Aurora PostgreSQL, or require_secure_transport = ON for Aurora MySQL\n   - Save. Reboot instances if changes are pending-reboot\n4. Verify the parameter group is associated to the target instance/cluster and status shows the new value applied",
+      "Terraform": "```hcl\n# DB instances\nresource \"aws_db_parameter_group\" \"example_pg\" {\n  name   = \"<example_resource_name>\"\n  family = \"<DB_PARAMETER_FAMILY>\"\n\n  parameter {\n    name  = \"rds.force_ssl\"\n    value = \"1\"  # Critical: requires SSL/TLS for PostgreSQL/SQL Server instances\n  }\n}\n\nresource \"aws_db_parameter_group\" \"example_mysql\" {\n  name   = \"<example_resource_name>\"\n  family = \"<DB_PARAMETER_FAMILY>\"\n\n  parameter {\n    name  = \"require_secure_transport\"\n    value = \"1\"  # Critical: requires SSL/TLS for MySQL/MariaDB instances\n  }\n}\n\n# Aurora clusters\nresource \"aws_rds_cluster_parameter_group\" \"example_aurora_pg\" {\n  name   = \"<example_resource_name>\"\n  family = \"<DB_CLUSTER_PARAMETER_FAMILY>\"\n\n  parameter {\n    name  = \"rds.force_ssl\"\n    value = \"1\"  # Critical: requires SSL/TLS for Aurora PostgreSQL clusters\n  }\n}\n\nresource \"aws_rds_cluster_parameter_group\" \"example_aurora_mysql\" {\n  name   = \"<example_resource_name>\"\n  family = \"<DB_CLUSTER_PARAMETER_FAMILY>\"\n\n  parameter {\n    name  = \"require_secure_transport\"\n    value = \"ON\"  # Critical: requires SSL/TLS for Aurora MySQL clusters\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Ensure that instances provisioned with Amazon RDS enforce SSL/TLS for client connections to meet security and compliance requirements.",
-      "Url": "https://aws.amazon.com/premiumsupport/knowledge-center/rds-connect-ssl-connection/"
+      "Text": "Enforce transport encryption at the database layer:\n- Enable `rds.force_ssl=1` or `require_secure_transport` in parameter groups\n- Configure clients to require certificate validation and prevent fallback\n- Use current TLS versions and trusted CAs\n- Prefer private network access as **defense in depth**",
+      "Url": "https://hub.prowler.com/check/rds_instance_transport_encrypted"
     }
   },
   "Categories": [

prowler/providers/aws/services/rds/rds_snapshots_encrypted/rds_snapshots_encrypted.metadata.json

@@ -1,26 +1,36 @@
 {
   "Provider": "aws",
   "CheckID": "rds_snapshots_encrypted",
-  "CheckTitle": "Check if RDS Snapshots and Cluster Snapshots are encrypted.",
-  "CheckType": [],
+  "CheckTitle": "RDS DB instance snapshot or DB cluster snapshot is encrypted",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "Effects/Data Exposure"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:snapshot",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
   "ResourceType": "AwsRdsDbSnapshot",
-  "Description": "Check if RDS Snapshots and Cluster Snapshots are encrypted.",
-  "Risk": "Ensure that your manual Amazon RDS database snapshots are encrypted in order to achieve compliance for data-at-rest encryption within your organization.",
-  "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-4",
+  "ResourceGroup": "database",
+  "Description": "**RDS DB snapshots** and **DB cluster snapshots** are evaluated for **encryption at rest**, identifying snapshots created with a KMS key versus unencrypted ones.",
+  "Risk": "Unencrypted snapshots enable direct access to full database data if backups are leaked, cross-account shared, or stolen. Adversaries can harvest data offline, bypassing network controls, leading to **loss of confidentiality**. Restores from such snapshots propagate the exposure to new instances.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/snapshot-encrypted.html#",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-4"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/snapshot-encrypted.html#",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/snapshot-encrypted.html#",
-      "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/snapshot-encrypted.html#"
+      "CLI": "aws rds copy-db-snapshot --source-db-snapshot-identifier <example_resource_id> --target-db-snapshot-identifier <example_resource_id>-encrypted --kms-key-id <KMS_KEY_ID>",
+      "NativeIaC": "",
+      "Other": "1. In the AWS Console, go to RDS > Snapshots\n2. Select the unencrypted snapshot (for clusters, use the DB cluster snapshots tab)\n3. Click Actions > Copy snapshot\n4. Check Enable encryption and choose a KMS key\n5. Click Copy snapshot and wait for completion\n6. After verifying the new encrypted snapshot, delete the original unencrypted snapshot (Actions > Delete snapshot)",
+      "Terraform": "```hcl\nresource \"aws_db_snapshot_copy\" \"<example_resource_name>\" {\n  source_db_snapshot_identifier = \"<example_resource_id>\"\n  target_db_snapshot_identifier = \"<example_resource_id>-encrypted\"\n  kms_key_id                    = \"<KMS_KEY_ID>\" # Critical: encrypts the copied snapshot using the specified KMS key\n}\n```"
     },
     "Recommendation": {
-      "Text": "When working with production databases that hold sensitive and critical data, it is strongly recommended to implement encryption at rest and protect your data from attackers or unauthorized personnel. ",
-      "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-4"
+      "Text": "Encrypt all RDS snapshots at rest using **KMS**, preferably **customer-managed keys**. Apply **least privilege** to key usage, enforce encryption via templates and automation, and prevent sharing of unencrypted backups. Use **key rotation**, separation of duties, and ensure copies and cross-account shares remain encrypted.",
+      "Url": "https://hub.prowler.com/check/rds_snapshots_encrypted"
     }
   },
   "Categories": [

prowler/providers/aws/services/rds/rds_snapshots_public_access/rds_snapshots_public_access.metadata.json

@@ -1,26 +1,37 @@
 {
   "Provider": "aws",
   "CheckID": "rds_snapshots_public_access",
-  "CheckTitle": "Check if RDS Snapshots and Cluster Snapshots are public.",
-  "CheckType": [],
+  "CheckTitle": "RDS snapshot is not publicly shared",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Effects/Data Exposure",
+    "TTPs/Collection"
+  ],
   "ServiceName": "rds",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:snapshot",
+  "ResourceIdTemplate": "",
   "Severity": "critical",
   "ResourceType": "AwsRdsDbSnapshot",
-  "Description": "Check if RDS Snapshots and Cluster Snapshots are public.",
-  "Risk": "Publicly accessible services could expose sensitive data to bad actors. t is recommended that your RDS snapshots should not be public in order to prevent potential leak or misuse of sensitive data or any other kind of security threat. If your RDS snapshot is public, then the data which is backed up in that snapshot is accessible to all other AWS accounts.",
-  "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/rds-snapshots-public-prohibited.html",
+  "ResourceGroup": "database",
+  "Description": "**RDS DB snapshots** and **DB cluster snapshots** with **public visibility** (shared with `all` AWS accounts) are detected.\n\nSnapshots limited to specific accounts or kept private are identified as restricted.",
+  "Risk": "Public RDS snapshots expose full database copies to all AWS accounts, risking:\n- Loss of confidentiality via data exfiltration (PII, secrets)\n- Offline cracking of hashes and schema reconnaissance\n- Credential harvesting from dumps enabling lateral movement\nThis directly compromises confidentiality and fuels targeted attacks.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/public-snapshots.html",
+    "https://docs.aws.amazon.com/config/latest/developerguide/rds-snapshots-public-prohibited.html",
+    "https://support.icompaas.com/support/solutions/articles/62000127056-ensure-rds-snapshots-and-cluster-snapshots-are-not-public"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot_id> --attribute-name restore --values-to-remove all",
       "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/public-snapshots.html",
+      "Other": "1. Open the Amazon RDS console and go to Snapshots\n2. Select the public snapshot (DB snapshot or DB cluster snapshot)\n3. Click Actions > Share snapshot\n4. Set visibility to Private (remove \"All\" from permissions) and click Save",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Use AWS Config to identify any snapshot that is public.",
-      "Url": "https://docs.aws.amazon.com/config/latest/developerguide/rds-snapshots-public-prohibited.html"
+      "Text": "Keep **RDS snapshots** and **cluster snapshots** private. Share only with explicit AWS account IDs using **least privilege** and time-bound access.\n\nEnforce guardrails to block `public` visibility, require approvals for sharing, and audit snapshot permissions. Use encryption with strict key policies to control who can restore data.",
+      "Url": "https://hub.prowler.com/check/rds_snapshots_public_access"
     }
   },
   "Categories": [

prowler/providers/aws/services/redshift/redshift_cluster_audit_logging/redshift_cluster_audit_logging.metadata.json

@@ -1,31 +1,38 @@
 {
   "Provider": "aws",
   "CheckID": "redshift_cluster_audit_logging",
-  "CheckTitle": "Check if Redshift cluster has audit logging enabled",
-  "CheckType": [],
+  "CheckTitle": "Redshift cluster has audit logging enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
   "ServiceName": "redshift",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:redshift:region:account-id:cluster:cluster-name",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRedshiftCluster",
-  "Description": "Check if Redshift cluster has audit logging enabled",
-  "Risk": "If logs are not enabled, monitoring of service use and threat analysis is not possible.",
-  "RelatedUrl": "https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html",
+  "ResourceGroup": "analytics",
+  "Description": "Amazon Redshift clusters are evaluated for **database audit logging** that exports connection, user, and user-activity events to Amazon S3 or CloudWatch.",
+  "Risk": "Without audit logs, malicious logins and queries can evade detection, impacting **confidentiality** (data exfiltration), **integrity** (unauthorized user/role changes), and **availability** of investigations due to missing evidence for forensics and incident response.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "https://docs.prowler.com/checks/aws/logging-policies/bc_aws_logging_12#cloudformation",
-      "Other": "https://docs.prowler.com/checks/aws/logging-policies/bc_aws_logging_12",
-      "Terraform": "https://docs.prowler.com/checks/aws/logging-policies/bc_aws_logging_12#terraform"
+      "CLI": "aws redshift enable-logging --cluster-identifier <example_resource_id> --bucket-name <S3_BUCKET_NAME>",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::Redshift::Cluster\n    Properties:\n      ClusterType: single-node\n      NodeType: dc2.large\n      DBName: mydb\n      MasterUsername: masteruser\n      MasterUserPassword: <PASSWORD>\n      # Critical: Enables Redshift audit logging to S3\n      LoggingProperties:\n        BucketName: <S3_BUCKET_NAME>  # Critical: Required to turn on logging\n```",
+      "Other": "1. Open the Amazon Redshift console and go to Clusters\n2. Select the target cluster and open the Properties tab\n3. In Database audit logging, click Edit\n4. Enable logging and select an S3 bucket\n5. Click Save changes",
+      "Terraform": "```hcl\nresource \"aws_redshift_cluster\" \"<example_resource_name>\" {\n  cluster_identifier = \"<example_resource_id>\"\n  node_type          = \"dc2.large\"\n  master_username    = \"masteruser\"\n  master_password    = \"SuperSecretPassw0rd!\"\n  cluster_type       = \"single-node\"\n\n  logging {\n    enable      = true                 # Critical: Turns on audit logging\n    bucket_name = \"<S3_BUCKET_NAME>\"  # Critical: S3 destination required\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable logs. Create an S3 lifecycle policy. Define use cases, metrics and automated responses where applicable.",
-      "Url": "https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html"
+      "Text": "Enable comprehensive **Redshift audit logging** and include user-activity events. Centralize logs in a protected destination, enforce **least privilege** access, retention, and immutability. Implement **alerts** for anomalous connections and queries as part of **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/redshift_cluster_audit_logging"
     }
   },
   "Categories": [
-    "forensics-ready",
-    "logging"
+    "logging",
+    "forensics-ready"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/redshift/redshift_cluster_automated_snapshot/redshift_cluster_automated_snapshot.metadata.json

@@ -1,29 +1,38 @@
 {
   "Provider": "aws",
   "CheckID": "redshift_cluster_automated_snapshot",
-  "CheckTitle": "Check if Redshift Clusters have automated snapshots enabled",
-  "CheckType": [],
+  "CheckTitle": "Redshift cluster has automated snapshots enabled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
   "ServiceName": "redshift",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:redshift:region:account-id:cluster:cluster-name",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
   "ResourceType": "AwsRedshiftCluster",
-  "Description": "Check if Redshift Clusters have automated snapshots enabled",
-  "Risk": "If backup is not enabled, data is vulnerable. Human error or bad actors could erase or modify data.",
-  "RelatedUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Redshift.html",
+  "ResourceGroup": "analytics",
+  "Description": "**Amazon Redshift clusters** are evaluated for **automated snapshots** being enabled with a retention period `> 0`, confirming that periodic backups are created and retained.",
+  "Risk": "Without **automated snapshots**, clusters lack recent recovery points, degrading **availability** and **integrity**.\n\nAccidental deletion, malicious changes, or failed ETL can cause data loss and prolonged recovery, increasing RPO/RTO and limiting effective forensic analysis.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Redshift.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "",
-      "Terraform": ""
+      "CLI": "aws redshift modify-cluster --cluster-identifier <example_resource_id> --automated-snapshot-retention-period 1",
+      "NativeIaC": "```yaml\n# CloudFormation: Enable automated snapshots for a Redshift cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::Redshift::Cluster\n    Properties:\n      ClusterType: single-node\n      NodeType: <NODE_TYPE>\n      DBName: <DB_NAME>\n      MasterUsername: <MASTER_USERNAME>\n      MasterUserPassword: <MASTER_PASSWORD>\n      AutomatedSnapshotRetentionPeriod: 1  # Critical: enables automated snapshots by retaining them for 1 day\n```",
+      "Other": "1. Open the AWS Console and go to Amazon Redshift\n2. Select your cluster and click Modify\n3. Under Backup, set Automated snapshot retention period to 1 (or greater)\n4. Click Save changes and apply the modification",
+      "Terraform": "```hcl\n# Terraform: Enable automated snapshots for a Redshift cluster\nresource \"aws_redshift_cluster\" \"<example_resource_name>\" {\n  cluster_identifier = \"<example_resource_id>\"\n  cluster_type       = \"single-node\"\n  node_type          = \"<NODE_TYPE>\"\n  database_name      = \"<DB_NAME>\"\n  master_username    = \"<MASTER_USERNAME>\"\n  master_password    = \"<MASTER_PASSWORD>\"\n\n  automated_snapshot_retention_period = 1  # Critical: enables automated snapshots by retaining them for 1 day\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable automated backup for production data. Define a retention period and periodically test backup restoration. A Disaster Recovery process should be in place to govern Data Protection approach",
-      "Url": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Redshift.html"
+      "Text": "Enable **automated snapshots** with retention aligned to RPO/RTO. Enforce **least privilege** on snapshot access and use **encryption**. Regularly test restores and monitor backup health.\n\n*For resilience*, replicate snapshots to another Region/account and separate backup administration from data owners.",
+      "Url": "https://hub.prowler.com/check/redshift_cluster_automated_snapshot"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "resilience"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/redshift/redshift_cluster_automatic_upgrades/redshift_cluster_automatic_upgrades.metadata.json

@@ -1,29 +1,39 @@
 {
   "Provider": "aws",
   "CheckID": "redshift_cluster_automatic_upgrades",
-  "CheckTitle": "Check for Redshift Automatic Version Upgrade",
-  "CheckType": [],
+  "CheckTitle": "Redshift cluster has automatic version upgrade enabled",
+  "CheckType": [
+    "Software and Configuration Checks/Patch Management",
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
   "ServiceName": "redshift",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:redshift:region:account-id:cluster:cluster-name",
-  "Severity": "high",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
   "ResourceType": "AwsRedshiftCluster",
-  "Description": "Check for Redshift Automatic Version Upgrade",
-  "Risk": "Without automatic version upgrade enabled, a critical Redshift Cluster version can become severly out of date",
-  "RelatedUrl": "https://docs.aws.amazon.com/redshift/latest/mgmt/managing-cluster-operations.html",
+  "ResourceGroup": "analytics",
+  "Description": "**Amazon Redshift clusters** have automatic major engine upgrades allowed via `AllowVersionUpgrade` so updates are applied during the maintenance window.",
+  "Risk": "Without automatic upgrades, clusters can run **vulnerable engine versions**, enabling exploits against known flaws.\n\nAttackers may read or tamper data (**confidentiality/integrity**), and unresolved bugs can cause downtime (**availability**). Delayed patching increases exposure window and operational risk.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-modify-redshift-maintenance.html",
+    "https://docs.aws.amazon.com/redshift/latest/mgmt/managing-cluster-operations.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "aws redshift modify-cluster --cluster-identifier <cluster_id> --allow-version-upgrade",
-      "NativeIaC": "https://docs.prowler.com/checks/aws/public-policies/public_9#cloudformation",
-      "Other": "",
-      "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-redshift-clusters-allow-version-upgrade-by-default#terraform"
+      "NativeIaC": "```yaml\n# CloudFormation to ensure Redshift allows major version upgrades\nResources:\n  <example_resource_name>:\n    Type: AWS::Redshift::Cluster\n    Properties:\n      ClusterType: single-node\n      DBName: <db_name>\n      MasterUsername: <master_username>\n      MasterUserPassword: <master_user_password>\n      NodeType: <node_type>\n      AllowVersionUpgrade: true  # Critical: enables automatic major version upgrades during the maintenance window\n```",
+      "Other": "1. Open the Amazon Redshift console\n2. Go to Clusters and select your cluster\n3. Click Edit (or Edit maintenance settings)\n4. Enable \"Major version upgrades\" (Allow version upgrade)\n5. Click Save changes",
+      "Terraform": "```hcl\n# Redshift cluster allowing automatic major version upgrades\nresource \"aws_redshift_cluster\" \"<example_resource_name>\" {\n  cluster_identifier = \"<example_resource_id>\"\n  node_type          = \"<node_type>\"\n  master_username    = \"<master_username>\"\n  master_password    = \"<master_user_password>\"\n\n  allow_version_upgrade = true  # Critical: enables automatic major version upgrades\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enabled AutomaticVersionUpgrade on Redshift Cluster",
-      "Url": "https://docs.aws.amazon.com/redshift/latest/mgmt/managing-cluster-operations.html"
+      "Text": "Enable `AllowVersionUpgrade` to keep clusters patched. Use a controlled maintenance window and an appropriate maintenance track; validate upgrades in staging before production.\n\nAlign with **secure-by-default** and **defense in depth**; keep tested backups and rollback plans. *Document justified exceptions and review regularly*.",
+      "Url": "https://hub.prowler.com/check/redshift_cluster_automatic_upgrades"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "vulnerabilities"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/aws/services/redshift/redshift_cluster_encrypted_at_rest/redshift_cluster_encrypted_at_rest.metadata.json

@@ -1,28 +1,37 @@
 {
   "Provider": "aws",
   "CheckID": "redshift_cluster_encrypted_at_rest",
-  "CheckTitle": "Check if Redshift clusters are encrypted at rest.",
+  "CheckTitle": "Redshift cluster is encrypted at rest",
   "CheckType": [
-    "Software and Configuration Checks/AWS Security Best Practices"
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "Effects/Data Exposure"
   ],
   "ServiceName": "redshift",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:redshift:region:account-id:cluster/cluster-name",
-  "Severity": "medium",
+  "ResourceIdTemplate": "",
+  "Severity": "critical",
   "ResourceType": "AwsRedshiftCluster",
-  "Description": "This control checks whether Amazon Redshift clusters are encrypted at rest. The control fails if a Redshift cluster isn't encrypted at rest.",
-  "Risk": "Without encryption at rest, sensitive data stored in Redshift clusters is vulnerable to unauthorized access, which could lead to data breaches and regulatory non-compliance.",
-  "RelatedUrl": "https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html",
+  "ResourceGroup": "analytics",
+  "Description": "**Amazon Redshift clusters** use **encryption at rest**. The evaluation inspects the cluster's encryption setting to determine if on-disk data and snapshots are protected with a managed key.",
+  "Risk": "Without **encryption at rest**, data blocks and snapshots can be read if storage media or backups are accessed by unauthorized parties. This compromises **confidentiality**, enabling bulk **data exfiltration** and exposure of sensitive analytics, which can facilitate further compromise.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/redshift/latest/mgmt/changing-cluster-encryption.html",
+    "https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-10"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws redshift modify-cluster --cluster-identifier <cluster-id> --encrypted --kms-key-id <key-id>",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-10",
-      "Terraform": ""
+      "CLI": "aws redshift modify-cluster --cluster-identifier <cluster-id> --encrypted",
+      "NativeIaC": "```yaml\n# CloudFormation: Enable at-rest encryption for a Redshift cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::Redshift::Cluster\n    Properties:\n      ClusterIdentifier: \"<example_resource_id>\"\n      DBName: \"<DB_NAME>\"\n      MasterUsername: \"<MASTER_USERNAME>\"\n      MasterUserPassword: \"<MASTER_PASSWORD>\"\n      NodeType: \"<NODE_TYPE>\"\n      ClusterType: \"<CLUSTER_TYPE>\"\n      Encrypted: true  # Critical: enables encryption at rest to pass the check\n```",
+      "Other": "1. Open the AWS Management Console and go to Amazon Redshift\n2. Choose Clusters, then select your cluster\n3. Open the Properties tab > Database configurations > Edit > Edit encryption\n4. Select Enable encryption (use AWS-managed or a specific KMS key)\n5. Click Save changes",
+      "Terraform": "```hcl\n# Terraform: Enable at-rest encryption for a Redshift cluster\nresource \"aws_redshift_cluster\" \"<example_resource_name>\" {\n  cluster_identifier = \"<example_resource_id>\"\n  node_type          = \"<NODE_TYPE>\"\n  cluster_type       = \"<CLUSTER_TYPE>\"\n  master_username    = \"<MASTER_USERNAME>\"\n  master_password    = \"<MASTER_PASSWORD>\"\n\n  encrypted = true  # Critical: enables encryption at rest to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable encryption at rest for your Redshift clusters using KMS to protect sensitive data from unauthorized access.",
-      "Url": "https://docs.aws.amazon.com/redshift/latest/mgmt/changing-cluster-encryption.html"
+      "Text": "Enable **encryption at rest** for all clusters and prefer **customer-managed keys** (`CMEK`) for control and auditing. Apply **least privilege** to key usage, rotate keys, and restrict snapshot access and cross-Region copies. Monitor key health and access events as part of **defense-in-depth**.",
+      "Url": "https://hub.prowler.com/check/redshift_cluster_encrypted_at_rest"
     }
   },
   "Categories": [

prowler/providers/aws/services/redshift/redshift_cluster_enhanced_vpc_routing/redshift_cluster_enhanced_vpc_routing.metadata.json

@@ -1,32 +1,40 @@
 {
   "Provider": "aws",
   "CheckID": "redshift_cluster_enhanced_vpc_routing",
-  "CheckTitle": "Check if Redshift clusters are using enhanced VPC routing.",
+  "CheckTitle": "Redshift cluster has Enhanced VPC Routing enabled",
   "CheckType": [
-    "Software and Configuration Checks/AWS Security Best Practices"
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
   ],
   "ServiceName": "redshift",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:redshift:region:account-id:cluster/cluster-name",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsRedshiftCluster",
-  "Description": "This control checks whether an Amazon Redshift cluster has EnhancedVpcRouting enabled. Enhanced VPC routing forces all COPY and UNLOAD traffic between the cluster and data repositories to go through your VPC, allowing you to use VPC security features such as security groups and network access control lists.",
-  "Risk": "Without enhanced VPC routing, network traffic between the Redshift cluster and data repositories might bypass VPC-level security controls, increasing the risk of unauthorized access or data exfiltration.",
-  "RelatedUrl": "https://docs.aws.amazon.com/redshift/latest/mgmt/enhanced-vpc-enabling-cluster.html",
+  "ResourceGroup": "analytics",
+  "Description": "**Amazon Redshift clusters** are assessed for the `EnhancedVpcRouting` setting, which routes all `COPY` and `UNLOAD` traffic between the cluster and data repositories through the VPC, enabling use of VPC security controls and logging.",
+  "Risk": "**Without enhanced VPC routing**, `COPY`/`UNLOAD` transfers can leave VPC oversight, reducing control and visibility.\n- VPC egress filtering and endpoint policies can be bypassed (confidentiality)\n- Limited flow-log telemetry (visibility)\n- Higher risk of unauthorized exfiltration or tampering (confidentiality, integrity)",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-7",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Redshift/enable-enhanced-vpc-routing.html",
+    "https://docs.aws.amazon.com/redshift/latest/mgmt/enhanced-vpc-routing.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "aws redshift modify-cluster --cluster-identifier <cluster-id> --enhanced-vpc-routing",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html#redshift-7",
-      "Terraform": ""
+      "NativeIaC": "```yaml\n# CloudFormation: Enable Enhanced VPC Routing on a Redshift cluster\nResources:\n  <example_resource_name>:\n    Type: AWS::Redshift::Cluster\n    Properties:\n      ClusterIdentifier: <example_resource_name>\n      ClusterType: single-node\n      NodeType: ra3.xlplus\n      DBName: dev\n      MasterUsername: <USERNAME>\n      MasterUserPassword: <PASSWORD>\n      EnhancedVpcRouting: true  # Critical: forces COPY/UNLOAD traffic through the VPC\n```",
+      "Other": "1. Open the AWS Console and go to Amazon Redshift\n2. Choose Provisioned clusters, select your cluster\n3. Click Actions > Modify\n4. In Network and security, turn on Enhanced VPC routing\n5. Click Save changes (apply immediately if prompted)",
+      "Terraform": "```hcl\n# Terraform: Enable Enhanced VPC Routing on a Redshift cluster\nresource \"aws_redshift_cluster\" \"<example_resource_name>\" {\n  cluster_identifier  = \"<example_resource_name>\"\n  cluster_type        = \"single-node\"\n  node_type           = \"ra3.xlplus\"\n  master_username     = \"<USERNAME>\"\n  master_password     = \"<PASSWORD>\"\n  enhanced_vpc_routing = true  # Critical: routes COPY/UNLOAD via VPC\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable enhanced VPC routing for your Redshift clusters to enforce network traffic through your VPC and apply additional security controls.",
-      "Url": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Redshift/enable-enhanced-vpc-routing.html"
+      "Text": "Enable `EnhancedVpcRouting` and enforce **least privilege** egress:\n- Prefer private access with VPC endpoints and restrictive policies\n- Constrain outbound paths via security groups, NACLs, and routing\n- Monitor transfers with VPC Flow Logs\n\nThis strengthens **defense in depth** and **zero trust** for data movement.",
+      "Url": "https://hub.prowler.com/check/redshift_cluster_enhanced_vpc_routing"
     }
   },
   "Categories": [
-    "trust-boundaries"
+    "trust-boundaries",
+    "internet-exposed"
   ],
   "DependsOn": [],
   "RelatedTo": [],