# Ensure ElastiCache Redis Cache Cluster Has In-Transit Encryption Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890036608477-ensure-elasticache-redis-cache-cluster-has-in-transit-encryption-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Amazon ElastiCache for Redis replication groups have in-transit encryption (TLS) enabled, so that traffic between clients and the cache cluster, as well as traffic between cluster nodes, is encrypted.

**Rationale**

Without in-transit encryption, traffic to and from the Redis cluster, potentially including sensitive cached data, session tokens, or other application state, travels unencrypted over the network, exposing it to interception if the network path is compromised or improperly segmented. Enabling in-transit encryption protects this data as it moves between clients, the cluster, and its replica nodes.

**Impact**

-   Protects potentially sensitive data in transit between clients and the Redis cluster
    
-   Supports compliance requirements mandating encryption of data in transit
    
-   In-transit encryption can only be enabled at replication group creation time and requires a TLS-capable Redis client configuration
    

**Default Value**

In-transit encryption is disabled by default for a newly created ElastiCache for Redis replication group unless explicitly enabled at creation.

**Pre-Requisites**

-   A Redis client library capable of connecting over TLS
    
-   IAM permissions to view and create ElastiCache replication groups (elasticache:DescribeReplicationGroups, elasticache:CreateReplicationGroup)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon ElastiCache > Redis clusters and select the replication group to review.
    
3.  Review the Encryption in transit field.
    
4.  Verify that it shows as Enabled.
    
5.  If encryption in transit is disabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon ElastiCache > Redis clusters.
    
3.  Because in-transit encryption cannot be enabled on an existing replication group, select Create Redis cluster to create a new one.
    
4.  Enable Encryption in transit (and, typically, Encryption at rest alongside it) during creation, and configure an AUTH token or Redis ACL user if authentication is also required.
    
5.  Update the application's Redis client configuration to connect using TLS (rediss://) to the new cluster's endpoint.
    
6.  Once traffic has cut over successfully, delete the old, unencrypted-in-transit cluster.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon ElastiCache > Redis clusters and select Create Redis cluster.
    
3.  Create a new cluster without Encryption in transit enabled, if reverting is required, and migrate the application back to it.
    
4.  Delete the encrypted-in-transit cluster once the migration is verified.
    

**Reference**

-   [https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.