ElastiCache Should Be Encrypted

Using Console

To remediate the misconfiguration of Elasticache not being encrypted at rest and in transit in AWS, you can follow the below steps:

Log in to your AWS console.
Go to the Elasticache service.
Select the cluster that you want to encrypt.
Click on the “Modify” button.
Scroll down to the “Advanced Redis Settings” section.
Enable the “Encryption in transit” option.
Select the “Require encryption” option.
Enable the “Encryption at rest” option.
Select the “AWS managed CMK” option.
Click on the “Save Changes” button.

After completing the above steps, your Elasticache cluster will be encrypted at rest and in transit using AWS managed CMK.

Using CLI

To remediate Elasticache misconfiguration for AWS using AWS CLI, you can follow the below steps:

First, you need to enable encryption at rest for Elasticache using AWS CLI. You can do this by running the following command:

aws elasticache modify-cache-cluster --cache-cluster-id <CACHE_CLUSTER_ID> --transit-encryption-enabled --at-rest-encryption-enabled --security-group-ids <SECURITY_GROUP_IDS>

In the above command, replace <CACHE_CLUSTER_ID> with the ID of the Elasticache cluster that you want to modify and <SECURITY_GROUP_IDS> with the IDs of the security groups that you want to associate with the cluster.

After enabling encryption at rest, you need to enable encryption in transit for Elasticache using AWS CLI. You can do this by running the following command:

aws elasticache modify-cache-cluster --cache-cluster-id <CACHE_CLUSTER_ID> --cache-security-group-names <CACHE_SECURITY_GROUP_NAMES> --security-group-ids <SECURITY_GROUP_IDS> --apply-immediately

In the above command, replace <CACHE_CLUSTER_ID> with the ID of the Elasticache cluster that you want to modify, <CACHE_SECURITY_GROUP_NAMES> with the names of the cache security groups that you want to associate with the cluster, and <SECURITY_GROUP_IDS> with the IDs of the security groups that you want to associate with the cluster.

Finally, verify that the Elasticache cluster is encrypted at rest and in transit. You can do this by running the following command:

aws elasticache describe-cache-clusters --cache-cluster-id <CACHE_CLUSTER_ID>

In the output of the above command, verify that the TransitEncryptionEnabled and AtRestEncryptionEnabled values are set to true.By following the above steps, you can remediate the Elasticache misconfiguration for AWS using AWS CLI.

Using Python

To remediate the misconfiguration in AWS Elasticache, you can use Python and follow these steps:

Open the AWS Elasticache console and select the cluster that you want to remediate.
Click on the “Security” tab and select the “Encryption in transit” option.
Enable encryption in transit by selecting the “Enable encryption in transit” checkbox.
Select the appropriate security group for your cluster.
Choose the SSL/TLS certificate that you want to use for encryption in transit.
Click on the “Save” button to save the changes.
Next, click on the “Encryption at rest” option.
Enable encryption at rest by selecting the “Enable encryption at rest” checkbox.
Choose the KMS key that you want to use for encryption at rest.
Click on the “Save” button to save the changes.
To automate the remediation process using Python, you can use the AWS SDK for Python (Boto3).
Install the Boto3 library using pip: pip install boto3
Create an AWS session using the boto3.Session() method.
Create an Elasticache client using the session.client('elasticache') method.
Use the modify_cache_cluster() method of the Elasticache client to update the cluster configuration.
Set the TransitEncryptionEnabled parameter to True to enable encryption in transit.
Set the AtRestEncryptionEnabled parameter to True to enable encryption at rest.
Set the KmsKeyId parameter to the ARN of the KMS key that you want to use for encryption at rest.
Call the modify_cache_cluster() method to apply the changes to the cluster.

Here’s some sample Python code that you can use to remediate the misconfiguration:

import boto3

# Create an AWS session
session = boto3.Session()

# Create an Elasticache client
elasticache = session.client('elasticache')

# Update the cluster configuration
response = elasticache.modify_cache_cluster(
    CacheClusterId='my-cluster',
    TransitEncryptionEnabled=True,
    AtRestEncryptionEnabled=True,
    KmsKeyId='arn:aws:kms:us-west-2:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234'
)

# Print the response
print(response)

Note: Replace my-cluster with the name of your Elasticache cluster and arn:aws:kms:us-west-2:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234 with the ARN of your KMS key.

Using Terraform

# New encrypted ElastiCache for Redis replication group created from a snapshot
# of the existing, unencrypted replication group (forces migration to a new
# cluster; you must later delete/stop managing the old replication group).

# 1. Take a snapshot of the existing, unencrypted replication group.
#    OLD_REPLICATION_GROUP_ID must be the ID of your current Redis group.
resource "aws_elasticache_snapshot" "migration" {
  snapshot_name       = "OLD_REPLICATION_GROUP_ID-migration-snapshot" # replace with desired snapshot name
  replication_group_id = "OLD_REPLICATION_GROUP_ID"                   # replace with your existing unencrypted replication group ID
}

# 2. Create a new, encrypted replication group from that snapshot.
resource "aws_elasticache_replication_group" "encrypted" {
  replication_group_id          = "OLD_REPLICATION_GROUP_ID-encrypted" # NEW ID; update apps to use this group's endpoint
  replication_group_description = "Encrypted replacement for OLD_REPLICATION_GROUP_ID"

  # Match these to the existing cluster's configuration
  engine               = "redis"
  engine_version       = "YOUR_REDIS_ENGINE_VERSION"  # e.g. "7.1"
  node_type            = "YOUR_NODE_TYPE"             # e.g. "cache.t3.medium"
  num_node_groups      = 1                            # or match your existing shard count
  replicas_per_node_group = 1                         # or match your existing replica count
  cache_subnet_group_name   = "YOUR_SUBNET_GROUP_NAME" # existing ElastiCache subnet group
  security_group_ids         = ["YOUR_SECURITY_GROUP_ID"] # existing VPC security group IDs

  # Encryption settings (immutable – changing requires replacement)
  at_rest_encryption_enabled  = true
  transit_encryption_enabled  = true

  # Seed from the snapshot of the old, unencrypted cluster
  snapshot_name = aws_elasticache_snapshot.migration.snapshot_name

  # Optional: ensure snapshot exists before creating replication group
  depends_on = [aws_elasticache_snapshot.migration]
}

# NOTE:
# - Enabling at_rest_encryption_enabled/transit_encryption_enabled on an existing
#   replication group is not supported; this Terraform change creates a NEW,
#   encrypted replication group. Switching traffic to it and deleting the old,
#   unencrypted group is a planned migration and may cause downtime if not
#   handled during a maintenance window.
# - After the new group is healthy, update your applications to use the new
#   primary endpoint (aws_elasticache_replication_group.encrypted.primary_endpoint_address),
#   then delete the old replication group (either via Terraform if it is managed
#   there, or manually/CLI otherwise).

# VERIFICATION:
# `terraform plan` should show:
# - 1 to add: aws_elasticache_snapshot.migration
# - 1 to add: aws_elasticache_replication_group.encrypted
# - (Optionally) 1 to destroy: the old, unencrypted aws_elasticache_replication_group
#   if it is currently managed in your Terraform and you removed/renamed it.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

ElastiCache Should Be Encrypted

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: