Description

Ensure that Amazon ElastiCache for Redis replication groups have encryption at rest enabled, so that data stored on disk (including snapshots and disk-backed data during failover or backup operations) is encrypted.

Rationale

Without encryption at rest, data written to disk as part of Redis persistence, backups, or swap operations is stored unencrypted, which does not meet common confidentiality requirements for cached application data, particularly when that data includes session information, tokens, or business-sensitive content. Enabling encryption at rest, optionally with a customer-managed KMS key, ensures this data is protected on the underlying storage.

Impact

  • Protects potentially sensitive cached data at rest on the underlying storage and in backups

  • Supports compliance requirements mandating encryption of data at rest

  • Encryption at rest can only be enabled at replication group creation time and cannot be changed on an existing cluster

Default Value

Encryption at rest is disabled by default for a newly created ElastiCache for Redis replication group unless explicitly enabled at creation.

Pre-Requisites

  • An AWS KMS key, if a customer-managed key is required (otherwise the AWS-managed default can be used)

  • IAM permissions to view and create ElastiCache replication groups (elasticache:DescribeReplicationGroups, elasticache:CreateReplicationGroup)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ElastiCache > Redis clusters and select the replication group to review.

  3. Review the Encryption at rest field.

  4. Verify that it shows as Enabled.

  5. If encryption at rest is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ElastiCache > Redis clusters.

  3. Because encryption at rest cannot be enabled on an existing replication group, select Create Redis cluster to create a new one.

  4. Enable Encryption at rest during creation, selecting the desired KMS key (AWS-managed or customer-managed).

  5. Migrate the application's connection configuration to the new cluster's endpoint, verifying functionality.

  6. Once traffic has cut over successfully, delete the old, unencrypted-at-rest cluster.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon ElastiCache > Redis clusters and select Create Redis cluster.

  3. Create a new cluster without Encryption at rest enabled, if reverting is required, and migrate the application back to it.

  4. Delete the encrypted cluster once the migration is verified.

Reference