Description

Ensure that Amazon ElastiCache clusters (Redis or Memcached) are deployed using a cache subnet group composed of private subnets, rather than public subnets that route directly to an internet gateway.

Rationale

ElastiCache clusters are intended to be accessed by application servers within the same VPC and are not designed to be directly internet-facing; placing a cluster's subnet group in public subnets increases the risk that a misconfigured security group or an associated public IP assignment (where applicable) could expose the cache endpoint to the internet. Using private subnets for the cache subnet group ensures the cluster is only reachable from within the VPC (or peered/connected networks), consistent with its intended architecture.

Impact

  • Reduces the risk of the cache endpoint being reachable from the public internet

  • Aligns cluster network placement with its intended internal-only access pattern

  • Cache subnet group placement is typically set at cluster creation and may require creating a new cluster to remediate

Default Value

There is no AWS-enforced default; the subnets included in the cache subnet group are explicitly selected at creation time and must be reviewed for correctness.

Pre-Requisites

  • Private subnets available in the target VPC for the ElastiCache cluster

  • IAM permissions to view and create cache subnet groups and clusters (elasticache:DescribeCacheSubnetGroups, elasticache:CreateCacheSubnetGroup, elasticache:CreateCacheCluster or elasticache:CreateReplicationGroup)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ElastiCache > Redis clusters or Memcached clusters and select the cluster to review.

  3. Review the Subnet group associated with the cluster.

  4. Navigate to Subnet groups, select the group in use, and review the listed subnets.

  5. Verify that each subnet does not have a route to an internet gateway (i.e., is a private subnet).

  6. If the cluster uses a subnet group containing public subnets, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ElastiCache > Subnet groups and select Create subnet group.

  3. Select only private subnets (subnets without a route to an internet gateway) for the new subnet group.

  4. Because a cluster's subnet group generally cannot be changed after creation for single-node clusters (and requires careful handling for replication groups), create a new cluster using the new, private subnet group.

  5. Migrate the application's connection configuration to the new cluster's endpoint, verifying connectivity and functionality.

  6. Decommission the old cluster using the public subnet group once the migration is verified.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ElastiCache > Subnet groups and create a new subnet group including the previous public subnets, if reverting is required.

  3. Create a new cluster using this subnet group, migrate the application back to it, and decommission the private-subnet cluster once verified.

Reference