Redshift.6: Redshift should auto-upgrade major versions

What does AWS Security Hub Redshift.6 check?

Redshift.6 evaluates a cluster's maintenance settings and fails any cluster where AllowVersionUpgrade is not true. With it enabled, the cluster picks up new major engine versions automatically during its chosen maintenance window.

Why does Redshift.6 matter?

A frozen warehouse is a slow-burning risk: nothing breaks the day you disable upgrades, but over months the cluster falls behind on security patches and bug fixes it would otherwise receive. Left long enough it hits the end-of-support cliff and AWS forces the upgrade on its own timing rather than yours. The finding also maps to NIST 800-53 patch-management controls.

How do I fix Redshift.6?

1. Set AllowVersionUpgrade to true on the cluster with modify-cluster.
2. Confirm the preferred maintenance window falls outside critical reporting periods.
3. Track AWS version-deprecation notices so upgrades land before any forced cutoff.
4. Enable the flag by default in cluster templates.

# Enable auto minor version upgrade on every RDS instance that has it disabled.
for id in $(aws rds describe-db-instances \
    --query 'DBInstances[?AutoMinorVersionUpgrade==`false`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$id" \
    --auto-minor-version-upgrade --no-apply-immediately
done

# Move a deprecated Lambda function to a supported runtime.
aws lambda update-function-configuration --function-name auth-token-issuer \
  --runtime nodejs22.x

# Upgrade an out-of-support EKS control plane one minor version at a time (then catch up node groups).
aws eks update-cluster-version --name prod-payments --kubernetes-version 1.29