Description

Ensure that Amazon ElastiCache for Redis replication groups have in-transit encryption (TLS) enabled, so that traffic between clients and the cache cluster, as well as traffic between cluster nodes, is encrypted.

Rationale

Without in-transit encryption, traffic to and from the Redis cluster, potentially including sensitive cached data, session tokens, or other application state, travels unencrypted over the network, exposing it to interception if the network path is compromised or improperly segmented. Enabling in-transit encryption protects this data as it moves between clients, the cluster, and its replica nodes.

Impact

  • Protects potentially sensitive data in transit between clients and the Redis cluster

  • Supports compliance requirements mandating encryption of data in transit

  • In-transit encryption can only be enabled at replication group creation time and requires a TLS-capable Redis client configuration

Default Value

In-transit encryption is disabled by default for a newly created ElastiCache for Redis replication group unless explicitly enabled at creation.

Pre-Requisites

  • A Redis client library capable of connecting over TLS

  • IAM permissions to view and create ElastiCache replication groups (elasticache:DescribeReplicationGroups, elasticache:CreateReplicationGroup)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ElastiCache > Redis clusters and select the replication group to review.

  3. Review the Encryption in transit field.

  4. Verify that it shows as Enabled.

  5. If encryption in transit is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ElastiCache > Redis clusters.

  3. Because in-transit encryption cannot be enabled on an existing replication group, select Create Redis cluster to create a new one.

  4. Enable Encryption in transit (and, typically, Encryption at rest alongside it) during creation, and configure an AUTH token or Redis ACL user if authentication is also required.

  5. Update the application's Redis client configuration to connect using TLS (rediss://) to the new cluster's endpoint.

  6. Once traffic has cut over successfully, delete the old, unencrypted-in-transit cluster.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ElastiCache > Redis clusters and select Create Redis cluster.

  3. Create a new cluster without Encryption in transit enabled, if reverting is required, and migrate the application back to it.

  4. Delete the encrypted-in-transit cluster once the migration is verified.

Reference