Description

Ensure that every Amazon ElastiCache replication group (Redis OSS or Valkey) has in-transit encryption enabled. In-transit encryption uses TLS to protect data moving between clients and the cache, and between nodes in the cluster.

Rationale

Without in-transit encryption, traffic between applications and the cache, and replication traffic between nodes, is sent in plaintext. Anyone able to observe or intercept this traffic can read keys, session tokens and cached sensitive data, or tamper with it through man-in-the-middle attacks, harming confidentiality and integrity. TLS should be enabled and, once all clients use it, enforced in the required mode, together with authentication (AUTH or RBAC) and restricted network access.

Impact

  • Protects cache traffic against eavesdropping and tampering

  • Clients must connect using TLS; in the preferred mode both encrypted and unencrypted connections are accepted, which allows clients to be migrated before TLS is enforced

  • Enabling in-transit encryption on an existing cache requires Redis OSS 7.0 or later, or Valkey; older engine versions must be upgraded first or the cache recreated

  • TLS adds some CPU overhead and latency

Default Value

In the ElastiCache API and AWS CLI, in-transit encryption is disabled unless it is enabled when the cache is created or modified.

Pre-Requisites

  • IAM permissions: elasticache:DescribeReplicationGroups and elasticache:ModifyReplicationGroup

  • An engine version that supports enabling in-transit encryption on an existing cache (Redis OSS 7.0 or later, or Valkey)

  • Client applications updated to connect with TLS

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ElastiCache console and select the Redis OSS (or Valkey) caches.

  3. Open each cache and check the Encryption in transit setting.

  4. Repeat for each region in use.

  5. If encryption in transit is disabled for any cache, follow the implementation steps.

CLI:

List all replication groups with their in-transit encryption settings:

aws elasticache describe-replication-groups --region <REGION> --query "ReplicationGroups[].[ReplicationGroupId,TransitEncryptionEnabled,TransitEncryptionMode]" --output table

A replication group fails if TransitEncryptionEnabled is false or not set.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ElastiCache console and select the Redis OSS (or Valkey) caches.

  3. Select the cache and choose Actions, then Modify.

  4. In the security settings, enable Encryption in transit and set the transit encryption mode to Preferred.

  5. Select Apply immediately (or leave the change for the next maintenance window), then confirm the modification.

  6. After all clients connect with TLS, modify the cache again and set the transit encryption mode to Required.

  7. Repeat for each affected cache in each region in use.

CLI:

Enable in-transit encryption in preferred mode:

aws elasticache modify-replication-group --replication-group-id <REPLICATION_GROUP_ID> --transit-encryption-enabled --transit-encryption-mode preferred --apply-immediately --region <REGION>

After all clients use TLS, enforce it:

aws elasticache modify-replication-group --replication-group-id <REPLICATION_GROUP_ID> --transit-encryption-mode required --apply-immediately --region <REGION>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ElastiCache console and select the cache.

  3. Choose Actions, then Modify.

  4. If the mode is Required, set it to Preferred and apply the change first.

  5. Then disable Encryption in transit and apply the change.

CLI:

aws elasticache modify-replication-group --replication-group-id <REPLICATION_GROUP_ID> --transit-encryption-mode preferred --apply-immediately --region <REGION>
aws elasticache modify-replication-group --replication-group-id <REPLICATION_GROUP_ID> --no-transit-encryption-enabled --apply-immediately --region <REGION>

Note: rolling back sends cache traffic in plaintext again. Clients must be switched back to unencrypted connections before encryption is disabled.

Reference