Description

Ensure that every Amazon ElastiCache replication group (Redis OSS or Valkey) has encryption at rest enabled. Encryption at rest protects data stored on disk, including data written during synchronization and swap operations and backups stored in Amazon S3.

Rationale

Without encryption at rest, cache data on disk and in backups can be read if the underlying storage or backup copies are accessed through a compromise or misconfiguration. Cached secrets, tokens and personal data could be exposed and analyzed offline. Encryption at rest can only be enabled when a cache is created, so an existing unencrypted cache must be replaced by a new encrypted one, preferably using a customer managed AWS KMS key with least-privilege key access, together with in-transit encryption and authentication.

Impact

  • Protects cache data on disk and in backups with encryption

  • Requires creating a new encrypted cache from a backup and switching applications to its endpoint, which needs a maintenance window

  • Writes made to the old cache after the backup is taken are not copied to the new cache

Default Value

In the ElastiCache API and AWS CLI, encryption at rest is disabled unless it is enabled when the replication group is created. It cannot be enabled on an existing replication group.

Pre-Requisites

  • IAM permissions: elasticache:DescribeReplicationGroups, elasticache:CreateSnapshot, elasticache:CreateReplicationGroup and elasticache:DeleteReplicationGroup, plus KMS permissions if a customer managed key is used

  • A maintenance window to switch applications to the new cache endpoint

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ElastiCache console and select the Redis OSS (or Valkey) caches.

  3. Open each cache and check the Encryption at rest setting.

  4. Repeat for each region in use.

  5. If encryption at rest is disabled for any cache, follow the implementation steps.

CLI:

List all replication groups with their at-rest encryption setting:

aws elasticache describe-replication-groups --region <REGION> --query "ReplicationGroups[].[ReplicationGroupId,AtRestEncryptionEnabled,KmsKeyId]" --output table

A replication group fails if AtRestEncryptionEnabled is false or not set.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon ElastiCache console and select the unencrypted cache.

  3. Create a manual backup of the cache and wait until it is available.

  4. Select Backups, select the backup and choose Restore.

  5. In the restore settings, enable Encryption at rest and choose the default key or a customer managed KMS key, then create the new cache.

  6. Update the applications to use the new cache endpoint and verify connectivity and data.

  7. Delete the old unencrypted cache.

  8. Repeat for each affected cache in each region in use.

Backout Plan

Keep the old unencrypted cache until the new one has been fully verified.

  1. Update the applications to use the original cache endpoint again.

  2. Delete the new encrypted cache if it is no longer needed.

Note: rolling back leaves the cache data unencrypted at rest. Once the original cache is deleted, it can only be recreated from a backup.

Reference