Profile Applicability:

  • Level 1

Description:

Amazon ElastiCache provides in-memory caching for improving performance of applications by offloading database workloads. Redis is one of the most popular engines used with ElastiCache, and it can be configured for high availability using Multi-AZ. When Multi-AZ is enabled for a Redis cache cluster, it provides automatic failover to a standby node in another availability zone in the event of an outage or failure, ensuring minimal downtime and increased reliability. This SOP ensures that Multi-AZ is enabled for your Redis cache clusters, improving availability and fault tolerance.

Rationale:

Enabling Multi-AZ for Redis cache clusters provides fault tolerance and high availability, reducing the risk of service interruptions. If a failure occurs in one Availability Zone (AZ), the system will automatically failover to a node in another AZ, maintaining data availability. Without Multi-AZ, a failure in the primary AZ could lead to significant downtime and service disruption. This configuration enhances the reliability, availability, and resilience of the caching layer in your application.

Impact:

Pros:

  • High Availability: Ensures that Redis remains available even if one AZ experiences an outage.

  • Automatic Failover: Automatically promotes a replica to primary when the primary node fails.

  • Reduced Downtime: Improves resilience against service disruptions, increasing uptime.

  • Improved Reliability: Reduces the risk of losing cached data due to node failure.

Cons:

  • Cost: Enabling Multi-AZ adds additional costs for the second replica node in another AZ.

  • Latency: Slight increase in latency due to data replication between multiple AZs.

Default Value:

By default, Elasticache Redis clusters are deployed in a single AZ. Multi-AZ must be explicitly enabled when creating the cache cluster.

Pre-requisite:

  • AWS IAM Permissions:

    • elasticache:DescribeCacheClusters

    • elasticache:CreateCacheCluster

    • elasticache:ModifyCacheCluster

  • AWS CLI installed and configured.

  • Understanding of Amazon ElastiCache, Redis, and high availability configurations.

Remediation:

Test Plan:

Using AWS Console:

  1. Sign in to the AWS Management Console.

  2. Navigate to ElastiCache under Services.

  3. In the ElastiCache Dashboard, select Redis from the list of clusters.

  4. Check if the Multi-AZ setting is enabled for the Redis cache cluster:

    • In the Cluster Details, check if the Multi-AZ setting is enabled for your cluster.

    • If Multi-AZ is not enabled, the cluster is not configured for high availability.

Using AWS CLI:

To check if Multi-AZ is enabled for your Redis cache cluster, run the following command:

aws elasticache describe-cache-clusters --cache-cluster-id <cluster-id> --query 'CacheClusters[*].{ID:CacheClusterId,MultiAZ:MultiAZ}' --output table

Review the output to confirm if Multi-AZ is enabled. If the output shows MultiAZ: true, it means Multi-AZ is enabled. If it shows false, then Multi-AZ is not enabled.

Implementation Steps:

Using AWS Console:

  1. Open the AWS Management Console 

  2. Navigate to ElastiCache.

  3. Select Redis from the list of available clusters.

  4. For any existing Redis cluster without Multi-AZ, click Modify.

  1. In the Multi-AZ section, select Enabled to configure the cluster for Multi-AZ deployment.

  2. Review the changes and click Apply Immediately to enable Multi-AZ.

Using AWS CLI:

To enable Multi-AZ for a Redis cache cluster, use the following command:

aws elasticache modify-cache-cluster --cache-cluster-id <cluster-id> --apply-immediately --multi-az-enabled

Verify that the Multi-AZ setting has been applied:

aws elasticache describe-cache-clusters --cache-cluster-id <cluster-id> --query 'CacheClusters[*].{ID:CacheClusterId,MultiAZ:MultiAZ}' --output table

Backout Plan:

If enabling Multi-AZ causes issues or unexpected behavior:

Identify the affected Redis cache cluster.

Revert the changes by disabling Multi-AZ:

aws elasticache modify-cache-cluster --cache-cluster-id <cluster-id> --apply-immediately --multi-az-disabled

Verify that the cache cluster is back to its original configuration and that it is functioning correctly.

References:

CIS Controls Mapping:

Version

Control ID

Control Description

IG1

IG2

IG3

v8

3.4

Encrypt Data on End-User Devices – Ensure data encryption during file system access.

v8

6.7

Implement Application Layer Filtering and Content Control – Ensure appropriate content filtering is applied to sensitive files.

v8

6.8

Define and Maintain Role-Based Access Control – Implement and manage role-based access for file systems.