Logo of Trend Micro
Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Redshift Nodes Counts

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: RS-021

Ensure that the number of Amazon Redshift cluster nodes provisioned in your AWS account has not reached the limit quota established by your organization for the Redshift workload deployed. By default, Cloud Conformity sets a threshold value of 5 for the maximum number of provisioned cluster nodes but you also have the capability to adjust this threshold based on your requirements, upon enabling this rule. Once you define your own threshold for the maximum number of Redshift cluster nodes that you need to run across all AWS regions, Cloud Conformity engine will start to continuously check your account for Redshift nodes and when the number of nodes reach the specified count (threshold) you will get notified via communication channels configured within your Cloud Conformity account. If the Redshift limit quota defined for your AWS account is reached, you can create an AWS support case to request limiting the number of provisioned Redshift nodes based on your requirements.

This rule can help you with the following compliance standards:

  • APRA
  • MAS

For further details on compliance standards supported by Conformity, see here.

This rule can help you work with the AWS Well-Architected Framework.

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Security

Audit

To determine the number of Redshift cluster nodes provisioned within your AWS account, perform the following:

Using AWS Console

01 Sign in to AWS Management Console.

02 Navigate to Redshift dashboard at https://console.aws.amazon.com/redshift/.

03 In the left navigation panel, under Redshift Dashboard, click Clusters.

04 Choose the Redshift cluster that you want to examine then click on its identifier/name link, listed in the Cluster column.

05 Within Properties section, check the Nodes attribute value (number) to determine the number of nodes provisioned within the selected cluster.

06 Go back to the Clusters page and repeat step no. 4 and 5 for each running cluster available to determine the number of nodes provisioned by other Redshift clusters within the current region.recommended.

07 Change the AWS region from the navigation bar and repeat steps no. 3 – 6 for all other regions. If the total number of Redshift cluster nodes provisioned in your AWS account is greater than 5, the defined threshold was exceeded, therefore you must take action and raise an AWS support case to limit the number of Redshift nodes based on your requirements.

Using AWS CLI

01 Run describe-clusters command (OSX/Linux/UNIX) using custom query filters to list the number of nodes for each Redshift cluster available within the selected AWS region: 

aws redshift describe-clusters
	--region us-east-1
	--query 'Clusters[*].[ClusterIdentifier,NumberOfNodes]'

02 The command output should return an array that contains pairs of metadata representing the identifier and the number of nodes for each Redshift cluster provisioned in the selected region: 

[
    [
        "cc-redshift-cluster",
        2
    ],
    [
        "cc-wdata-cluster",
        5
    ],
    [
        "cc-production-cluster",
        16
    ],
]

03 Repeat step no. 1 and 2 to execute describe-clusters command for all other AWS regions. Each command output should return all Redshift cluster identifiers and the number of nodes for each cluster, available in the selected region. If the total number of Redshift nodes returned is greater than 5 (combined), the defined limit threshold was exceeded, therefore you must take action and raise an AWS support case to limit the number of Redshift cluster nodes that can be created in your account.

Remediation / Resolution

To raise an AWS support case to request limiting the number of provisioned Redshift cluster nodes in your AWS account based on your requirements, perform the following actions:

Note: Requesting a limit for the number of Redshift nodes per region using the AWS API via Command Line Interface (CLI) is not currently supported.

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to AWS Support Center dashboard at https://console.aws.amazon.com/support/.

03 In the left navigation panel, choose Create Case to create a new AWS support case.

04 On the Create Case page, perform the following:

  1. Under Regarding, select Service Limit Increase.
  2. Choose Redshift from the Limit Type dropdown list.
  3. In the Request 1 section, perform the following actions:
    • From the Region dropdown list, select the AWS region where you need to limit the creation of Redshift cluster nodes.
    • Select Per Account Node Limit from the Limit dropdown list.
    • In the New limit value box, enter the limit value to request for the number of provisioned Redshift nodes.
  4. In the Use Case Description textbox, enter a brief description where you explain the limit request so AWS support can evaluate your case faster.
  5. From Supported Language, choose your preferred correspondence language for the current case.
  6. Under Contact method, select a preferred contact method that AWS support team can use to respond to your request.
  7. Click Submit to send the limit request to Amazon Web Services. A customer support representative will contact you shortly.

References

Publication date Sep 13, 2017

Related Redshift rules