---
title: "Redshift does not use SSL"
canonical: "https://kb.cynergy.app/space/MD/1209597958/Redshift%20does%20not%20use%20SSL"
format: markdown
---
# Description

This policy detects Redshift databases where connections are made over insecure channels. Enforcing SSL connections ensures that data in transit is protected, maintaining secure communication between the database and its clients.

# Fix - Runtime

## AWS Console

1. Login to the AWS and navigate to the `Amazon Redshift` service.
2. Expand the identified `Redshift` cluster and make a note of the `Cluster Parameter Group`
3. In the navigation panel, click on the `Parameter group`.
4. Select the identified `Parameter Group` and click on `Edit Parameters`.
5. Review the require_ssl flag. Update the parameter `require_ssl` to true and save it.  
Note: If the current parameter group is a Default parameter group, it cannot be edited. You will need to create a new parameter group and point it to an affected cluster.

# Fix - Build time

## Terraform

- **Resource**: aws_redshift_parameter_group
- **Argument**: parameter.require_ssl

```go aws_s3_bucket.test.tf resource "aws_redshift_parameter_group" "pass" { ... parameter { name = "require_ssl" value = "true" } }

```

## CloudFormation

- **Resource**: AWS::Redshift::ClusterParameterGroup
- **Argument**:  Properties.Parameters

```yaml
Type: AWS::Redshift::ClusterParameterGroup
    Properties:
      ...
      Parameters:
+       - ParameterName: "require_ssl"
+         ParameterValue: "true"
```