> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-343.md).

# Amazon Redshift clusters do not have automatic snapshots enabled misconfiguration detected in code

## Rule Details

|                        |                           |
| ---------------------- | ------------------------- |
| Cortex AppSec Rule ID  | APPSEC\_AWS\_343          |
| Category - Subcategory | Storage - Backups         |
| Provider               | AWS                       |
| Severity               | HIGH                      |
| Framework              | Terraform, Terraform Plan |

## Impact

This rule is ensuring that Amazon Redshift clusters have automatic snapshots enabled. Snapshots are point-in-time copies of a database, and can be used to recover data if the database gets deleted or corrupted. Automatic snapshots specifically are snapshots that are automatically created by an automated system on a regular schedule.

The rule is checking for a specific setting, which is whether "automatic snapshots" is enabled or not. If this setting is turned off, then snapshots are not being automatically created, and you would need to manually create snapshots whenever you want to back up the database. This can be risky and time-consuming.

If this setting is not enabled, the risk would be losing substantial data in the event of a database failure or corruption. Without a recent snapshot to restore from, any changes made since the last manual snapshot would be lost.

## How to Fix

*Resource:* aws\_redshift\_cluster

* *Arguments:* automated\_snapshot\_retention\_period

To fix the issue, we need to make sure Amazon Redshift clusters have autopause enabled. We can do this by setting the `automated_snapshot_retention_period` attribute to a positive integer value, denoting the number of days to retain the automated snapshots.

## The above code ensures the Redshift cluster will have automated snapshots enabled, keeping a daily backup. The recovery process will be straightforward, minimizing the risk of lost data. The `automated_snapshot_retention_period` parameter is set to 1, indicating that each automatic snapshot should be kept for 1 day before it is deleted. It's good practice to have some form of automatic backup enabled for data recovery purposes. \[source,go]

## resource "aws\_redshift\_cluster" "default" { cluster\_identifier = "tf-redshift-cluster" database\_name = "mydb" master\_username = "foo" master\_password = "Mustbe8characters" cluster\_type = "multi-node" node\_type = "dc1.large" number\_of\_nodes = 2 automated\_snapshot\_retention\_period = 1 // set to a positive integer }


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-343.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.