# Amazon Redshift
AWS Systems Manager Automation provides predefined runbooks for Amazon Redshift. For more information about runbooks, see [Working with runbooks](https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-documents.html). For information about how to view runbook content, see [View runbook content](automation-runbook-reference.md#view-automation-json).
**Topics**
+ [`AWSConfigRemediation-DeleteRedshiftCluster`](automation-aws-delete-redshift.md)
+ [`AWSConfigRemediation-DisablePublicAccessToRedshiftCluster`](automation-aws-disable-redshift-public-access.md)
+ [`AWSConfigRemediation-EnableRedshiftClusterAuditLogging`](automation-aws-enable-redshift-audit.md)
+ [`AWSConfigRemediation-EnableRedshiftClusterAutomatedSnapshot`](automation-aws-enable-redshift-snapshot.md)
+ [`AWSConfigRemediation-EnableRedshiftClusterEncryption`](automation-aws-enable-redshift-encrypt.md)
+ [`AWSConfigRemediation-EnableRedshiftClusterEnhancedVPCRouting`](automation-aws-enable-redshift-enhanced-routing.md)
+ [`AWSConfigRemediation-EnforceSSLOnlyConnectionsToRedshiftCluster`](automation-aws-enforce-redshift-ssl-only.md)
+ [`AWSConfigRemediation-ModifyRedshiftClusterMaintenanceSettings`](automation-aws-modify-redshift-maintenance.md)
+ [`AWSConfigRemediation-ModifyRedshiftClusterNodeType`](automation-aws-modify-redshift-cluster-node.md)
# `AWSConfigRemediation-DeleteRedshiftCluster`
**Description**
The `AWSConfigRemediation-DeleteRedshiftCluster` runbook deletes the Amazon Redshift cluster you specify.
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSConfigRemediation-DeleteRedshiftCluster)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Databases
**Parameters**
+ AutomationAssumeRole
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.
+ ClusterIdentifier
Type: String
Description: (Required) The ID of the Amazon Redshift cluster that you want to delete.
+ SkipFinalClusterSnapshot
Type: Boolean
Default: false
Description: (Optional) If set to `false` , the automation creates a snapshot before deleting the Amazon Redshift cluster. If set to `true` , a final cluster snapshot is not created.
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `ssm:StartAutomationExecution`
+ `ssm:GetAutomationExecution`
+ `redshift:DeleteCluster`
+ `redshift:DescribeClusters`
**Document Steps**
+ `aws:branch` - Branches based on the value you specify for the `SkipFinalClusterSnapshot` parameter.
+ `aws:executeAwsApi` - Deletes the Amazon Redshift cluster specified in the `ClusterIdentifier` parameter.
+ `aws:assertAwsResourceProperty` - Verifies the Amazon Redshift cluster has been deleted.
# `AWSConfigRemediation-DisablePublicAccessToRedshiftCluster`
**Description**
The `AWSConfigRemediation-DisablePublicAccessToRedshiftCluster` runbook disables public accessibility for the Amazon Redshift cluster that you specify.
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSConfigRemediation-DisablePublicAccessToRedshiftCluster)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Databases
**Parameters**
+ AutomationAssumeRole
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.
+ ClusterIdentifier
Type: String
Description: (Required) The unique identifier of the cluster that you want to disable public accessibility for.
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `ssm:StartAutomationExecution`
+ `ssm:GetAutomationExecution`
+ `redshift:DescribeClusters`
+ `redshift:ModifyCluster`
**Document Steps**
+ `aws:executeAwsApi` - Disables public accessibility for the cluster specified in the `ClusterIdentifier` parameter.
+ `aws:waitForAwsResourceProperty` - Waits for the state of the cluster to change to `available` .
+ `aws:assertAwsResourceProperty` - Confirms the public accessibility setting is disabled on the cluster.
# `AWSConfigRemediation-EnableRedshiftClusterAuditLogging`
**Description**
The `AWSConfigRemediation-EnableRedshiftClusterAuditLogging` runbook enables audit logging for the Amazon Redshift cluster you specify.
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSConfigRemediation-EnableRedshiftClusterAuditLogging)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Databases
**Parameters**
+ AutomationAssumeRole
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.
+ BucketName
Type: String
Description: (Required) The name of the Amazon Simple Storage Service (Amazon S3) bucket you want to upload logs to.
+ ClusterIdentifier
Type: String
Description: (Required) The unique identifier of the cluster you want to enable audit logging on.
+ S3KeyPrefix
Type: String
Description: (Optional) The Amazon S3 key prefix (subfolder) you want to upload logs to.
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `ssm:StartAutomationExecution`
+ `ssm:GetAutomationExecution`
+ `redshift:DescribeLoggingStatus`
+ `redshift:EnableLogging`
+ `s3:GetBucketAcl`
+ `s3:PutObject`
**Document Steps**
+ `aws:branch` - Branches based on whether a value was specified for the `S3KeyPrefix` parameter.
+ `aws:executeAwsApi` - Enables audit logging on the cluster specified in the `ClusterIdentifier` parameter.
+ `aws:assertAwsResourceProperty` - Verifies audit logging was enabled on the cluster.
# `AWSConfigRemediation-EnableRedshiftClusterAutomatedSnapshot`
**Description**
The `AWSConfigRemediation-EnableRedshiftClusterAutomatedSnapshot` runbook enables automated snapshots for the Amazon Redshift cluster you specify.
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSConfigRemediation-EnableRedshiftClusterAutomatedSnapshot)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Databases
**Parameters**
+ AutomationAssumeRole
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.
+ AutomatedSnapshotRetentionPeriod
Type: Integer
Valid values: 1-35
Description: (Required) The number of days that automated snapshots are retained.
+ ClusterIdentifier
Type: String
Description: (Required) The unique identifier of the cluster you want to enable automated snapshots on.
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `ssm:StartAutomationExecution`
+ `ssm:GetAutomationExecution`
+ `redshift:DescribeClusters`
+ `redshift:ModifyCluster`
**Document Steps**
+ `aws:executeAwsApi` - Enables automation snapshots on the cluster specified in the `ClusterIdentifier` parameter.
+ `aws:waitForAwsResourceProperty` - Waits for the state of the cluster to change to `available` .
+ `aws:executeScript` - Confirms automated snapshots were enabled on the cluster.
# `AWSConfigRemediation-EnableRedshiftClusterEncryption`
**Description**
The `AWSConfigRemediation-EnableRedshiftClusterEncryption` runbook enables encryption on the Amazon Redshift cluster you specify using an AWS Key Management Service (AWS KMS) customer managed key. This runbook should only be used as a baseline to ensure that your Amazon Redshift clusters are encrypted according to minimum recommended security best practices. We recommend encrypting multiple clusters with different customer managed keys. This runbook cannot change the AWS KMS customer managed key used on an already encrypted cluster. To change the AWS KMS customer managed key used to encrypt a cluster, you must first disable encryption on the cluster.
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSConfigRemediation-EnableRedshiftClusterEncryption)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Databases
**Parameters**
+ AutomationAssumeRole
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.
+ ClusterIdentifier
Type: String
Description: (Required) The unique identifier of the cluster you want to enable encryption on.
+ KMSKeyARN
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS KMS customer managed key you want to use to encrypt the cluster's data.
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `ssm:StartAutomationExecution`
+ `ssm:GetAutomationExecution`
+ `redshift:DescribeClusters`
+ `redshift:ModifyCluster`
**Document Steps**
+ `aws:executeAwsApi` - Enables encryption on the Amazon Redshift cluster specified in the `ClusterIdentifier` parameter.
+ `aws:assertAwsResourceProperty` - Verifies encryption has been enabled on the cluster.
# `AWSConfigRemediation-EnableRedshiftClusterEnhancedVPCRouting`
**Description**
The `AWSConfigRemediation-EnableRedshiftClusterEnhancedVPCRouting` runbook enables enhanced virtual private cloud (VPC) routing for the Amazon Redshift cluster you specify. For information about enhanced VPC routing, see [Amazon Redshift enhanced VPC routing](https://docs.aws.amazon.com/redshift/latest/gsg/enhanced-vpc-routing.html) in the *Amazon Redshift Management Guide* .
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSConfigRemediation-EnableRedshiftClusterEnhancedVPCRouting)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Databases
**Parameters**
+ AutomationAssumeRole
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.
+ ClusterIdentifier
Type: String
Description: (Required) The unique identifier of the cluster you want to enable enhanced VPC routing on.
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `ssm:StartAutomationExecution`
+ `ssm:GetAutomationExecution`
+ `redshift:DescribeClusters`
+ `redshift:ModifyCluster`
**Document Steps**
+ `aws:executeAwsApi` - Enables enhanced VPC routing on the cluster specified in the `ClusterIdentifier` parameter.
+ `assertAwsResourceProperty` - Confirms enhanced VPC routing was enabled on the cluster.
# `AWSConfigRemediation-EnforceSSLOnlyConnectionsToRedshiftCluster`
**Description**
The `AWSConfigRemediation-EnforceSSLOnlyConnectionsToRedshiftCluster` runbook requires incoming connections to use SSL for the Amazon Redshift cluster you specify.
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSConfigRemediation-EnforceSSLOnlyConnectionsToRedshiftCluster)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Databases
**Parameters**
+ AutomationAssumeRole
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.
+ ClusterIdentifier
Type: String
Description: (Required) The unique identifier of the cluster you want to enable enhanced VPC routing on.
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `ssm:StartAutomationExecution`
+ `ssm:GetAutomationExecution`
+ `redshift:DescribeClusters`
+ `redshift:DescribeClusterParameters`
+ `redshift:ModifyClusterParameterGroup`
**Document Steps**
+ `aws:executeAwsApi` - Gathers parameter details from the cluster specified in the `ClusterIdentifier` parameter.
+ `aws:executeAwsApi` - Enables the `require_ssl` setting on the cluster specified in the `ClusterIdentifier` parameter.
+ `aws:assertAwsResourceProperty` - Confirms the `require_ssl` setting was enabled on the cluster.
+ `aws:executeScript` - Verifies the `require_ssl` setting for the cluster.
# `AWSConfigRemediation-ModifyRedshiftClusterMaintenanceSettings`
**Description**
The `AWSConfigRemediation-ModifyRedshiftClusterMaintenanceSettings` runbook modifies the maintenance settings for the Amazon Redshift cluster you specify.
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSConfigRemediation-ModifyRedshiftClusterMaintenanceSettings)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Databases
**Parameters**
+ AllowVersionUpgrade
Type: Boolean
Description: (Required) If set to `true` , major version upgrades are applied automatically to the cluster during the maintenance window.
+ AutomationAssumeRole
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.
+ AutomatedSnapshotRetentionPeriod
Type: Integer
Valid values: 1-35
Description: (Required) The number of days automated snapshots are retained.
+ ClusterIdentifier
Type: String
Description: (Required) The unique identifier of the cluster you want to enable enhanced VPC routing on.
+ PreferredMaintenanceWindow
Type: String
Description: (Required) The weekly time range (in UTC) during which system maintenance can occur.
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `ssm:StartAutomationExecution`
+ `ssm:GetAutomationExecution`
+ `redshift:DescribeClusters`
+ `redshift:ModifyCluster`
**Document Steps**
+ `aws:executeAwsApi` - Modifies the maintenance settings for the cluster specified in the `ClusterIdentifier` parameter.
+ `aws:assertAwsResourceProperty` - Confirms the modified maintenance settings were configured for the cluster.
# `AWSConfigRemediation-ModifyRedshiftClusterNodeType`
**Description**
The `AWSConfigRemediation-ModifyRedshiftClusterNodeType` runbook modifies the node type and number of nodes for the Amazon Redshift cluster you specify.
[Run this Automation (console)](https://console.aws.amazon.com/systems-manager/automation/execute/AWSConfigRemediation-ModifyRedshiftClusterNodeType)
**Document type**
Automation
**Owner**
Amazon
**Platforms**
Databases
**Parameters**
+ AutomationAssumeRole
Type: String
Description: (Required) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf.
+ Classic
Type: Boolean
Description: (Optional) If set to `true` , the resize operation uses the classic resize process.
+ ClusterIdentifier
Type: String
Description: (Required) The unique identifier of the cluster whose node type you want to modify.
+ ClusterType
Type: String
Valid values: single-node \$1 multi-node
Description: (Required) The type of cluster you want to assign to your cluster.
+ NodeType
Type: String
Valid values: ds2.xlarge \$1 ds2.8xlarge \$1 dc1.large \$1 dc1.8xlarge \$1 dc2.large \$1 dc2.8xlarge \$1 ra3.4xlarge \$1 ra3.16xlarge
Description: (Required) The type of node you want to assign to your cluster.
+ NumberOfNodes
Type: Integer
Valid values: 2-100
Description: (Optional) The number of nodes you want to assign to your cluster. If your cluster is a `single-node` type, do not specify a value for this parameter.
**Required IAM permissions**
The `AutomationAssumeRole` parameter requires the following actions to use the runbook successfully.
+ `ssm:StartAutomationExecution`
+ `ssm:GetAutomationExecution`
+ `redshift:DescribeClusters`
+ `redshift:ResizeCluster`
**Document Steps**
+ `aws:executeScript` - Modifies the node type and number of nodes for the cluster specified in the `ClusterIdentifier` parameter.