Amazon Redshift clusters are by default not publicly accessible.

Enabling public access to a cluster results in a wider attack surface for the organization.

Example 1: The following example shows an Ansible task that explicitly enables public access to an Amazon Redshift cluster by setting the publicly_accessible parameter to yes.

- name: example1
  community.aws.redshift:
    identifier: mycluster
    command: create
    db_name: mydb
    node_type: ds1.xlarge
    username: "{{ username }}"
    password: "{{ password }}"
    publicly_accessible: yes

Uncontrolled access to critical or sensitive resources can significantly impact an organization in various ways, including disclosure of or tampering with critical data.

A misconfiguration of public access to an S3 bucket is a leading cause of data breaches.

Although S3 buckets block public access by default, any authorized user can update bucket policies or access control lists (ACLs) to allow public access.

Uncontrolled access to critical or sensitive resources can significantly impact an organization in various ways, including disclosure of or tampering with critical data.

Insufficiently protected data communication channels can put critical organizational data at risk of theft, tampering, or disclosure.

Amazon CloudFront Distribution can be misconfigured to allow unauthenticated or unencrypted communication, or use an outdated protocol. Such misconfigurations can cause compromise and allow an attacker, residing on a shared network, to snoop and tamper with data in transit.

Insufficiently protected data communication channels can put critical organizational data at risk of theft, tampering, or disclosure.