> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Elastic cache with encryption remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of Elasticache not being encrypted at rest and in transit in AWS, you can follow the below steps: 1. Log in to your AWS console. 2. Go to the Elasticache service. 3. Select the cluster that you want to encrypt. 4. Click on the "Modify" button. 5. Scroll down to the "Advanced Redis Settings" section. 6. Enable the "Encryption in transit" option. 7. Select the "Require encryption" option. 8. Enable the "Encryption at rest" option. 9. Select the "AWS managed CMK" option. 10. Click on the "Save Changes" button. After completing the above steps, your Elasticache cluster will be encrypted at rest and in transit using AWS managed CMK. # To remediate Elasticache misconfiguration for AWS using AWS CLI, you can follow the below steps: 1. First, you need to enable encryption at rest for Elasticache using AWS CLI. You can do this by running the following command: ``` aws elasticache modify-cache-cluster --cache-cluster-id --transit-encryption-enabled --at-rest-encryption-enabled --security-group-ids ``` In the above command, replace `` with the ID of the Elasticache cluster that you want to modify and `` with the IDs of the security groups that you want to associate with the cluster. 2. After enabling encryption at rest, you need to enable encryption in transit for Elasticache using AWS CLI. You can do this by running the following command: ``` aws elasticache modify-cache-cluster --cache-cluster-id --cache-security-group-names --security-group-ids --apply-immediately ``` In the above command, replace `` with the ID of the Elasticache cluster that you want to modify, `` with the names of the cache security groups that you want to associate with the cluster, and `` with the IDs of the security groups that you want to associate with the cluster. 3. Finally, verify that the Elasticache cluster is encrypted at rest and in transit. You can do this by running the following command: ``` aws elasticache describe-cache-clusters --cache-cluster-id ``` In the output of the above command, verify that the `TransitEncryptionEnabled` and `AtRestEncryptionEnabled` values are set to `true`. By following the above steps, you can remediate the Elasticache misconfiguration for AWS using AWS CLI. To remediate the misconfiguration in AWS Elasticache, you can use Python and follow these steps: 1. Open the AWS Elasticache console and select the cluster that you want to remediate. 2. Click on the "Security" tab and select the "Encryption in transit" option. 3. Enable encryption in transit by selecting the "Enable encryption in transit" checkbox. 4. Select the appropriate security group for your cluster. 5. Choose the SSL/TLS certificate that you want to use for encryption in transit. 6. Click on the "Save" button to save the changes. 7. Next, click on the "Encryption at rest" option. 8. Enable encryption at rest by selecting the "Enable encryption at rest" checkbox. 9. Choose the KMS key that you want to use for encryption at rest. 10. Click on the "Save" button to save the changes. 11. To automate the remediation process using Python, you can use the AWS SDK for Python (Boto3). 12. Install the Boto3 library using pip: `pip install boto3` 13. Create an AWS session using the `boto3.Session()` method. 14. Create an Elasticache client using the `session.client('elasticache')` method. 15. Use the `modify_cache_cluster()` method of the Elasticache client to update the cluster configuration. 16. Set the `TransitEncryptionEnabled` parameter to `True` to enable encryption in transit. 17. Set the `AtRestEncryptionEnabled` parameter to `True` to enable encryption at rest. 18. Set the `KmsKeyId` parameter to the ARN of the KMS key that you want to use for encryption at rest. 19. Call the `modify_cache_cluster()` method to apply the changes to the cluster. Here's some sample Python code that you can use to remediate the misconfiguration: ```python theme={null} import boto3 # Create an AWS session session = boto3.Session() # Create an Elasticache client elasticache = session.client('elasticache') # Update the cluster configuration response = elasticache.modify_cache_cluster( CacheClusterId='my-cluster', TransitEncryptionEnabled=True, AtRestEncryptionEnabled=True, KmsKeyId='arn:aws:kms:us-west-2:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234' ) # Print the response print(response) ``` Note: Replace `my-cluster` with the name of your Elasticache cluster and `arn:aws:kms:us-west-2:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234` with the ARN of your KMS key. ```hcl theme={null} # New encrypted ElastiCache for Redis replication group created from a snapshot # of the existing, unencrypted replication group (forces migration to a new # cluster; you must later delete/stop managing the old replication group). # 1. Take a snapshot of the existing, unencrypted replication group. # OLD_REPLICATION_GROUP_ID must be the ID of your current Redis group. resource "aws_elasticache_snapshot" "migration" { snapshot_name = "OLD_REPLICATION_GROUP_ID-migration-snapshot" # replace with desired snapshot name replication_group_id = "OLD_REPLICATION_GROUP_ID" # replace with your existing unencrypted replication group ID } # 2. Create a new, encrypted replication group from that snapshot. resource "aws_elasticache_replication_group" "encrypted" { replication_group_id = "OLD_REPLICATION_GROUP_ID-encrypted" # NEW ID; update apps to use this group's endpoint replication_group_description = "Encrypted replacement for OLD_REPLICATION_GROUP_ID" # Match these to the existing cluster's configuration engine = "redis" engine_version = "YOUR_REDIS_ENGINE_VERSION" # e.g. "7.1" node_type = "YOUR_NODE_TYPE" # e.g. "cache.t3.medium" num_node_groups = 1 # or match your existing shard count replicas_per_node_group = 1 # or match your existing replica count cache_subnet_group_name = "YOUR_SUBNET_GROUP_NAME" # existing ElastiCache subnet group security_group_ids = ["YOUR_SECURITY_GROUP_ID"] # existing VPC security group IDs # Encryption settings (immutable – changing requires replacement) at_rest_encryption_enabled = true transit_encryption_enabled = true # Seed from the snapshot of the old, unencrypted cluster snapshot_name = aws_elasticache_snapshot.migration.snapshot_name # Optional: ensure snapshot exists before creating replication group depends_on = [aws_elasticache_snapshot.migration] } # NOTE: # - Enabling at_rest_encryption_enabled/transit_encryption_enabled on an existing # replication group is not supported; this Terraform change creates a NEW, # encrypted replication group. Switching traffic to it and deleting the old, # unencrypted group is a planned migration and may cause downtime if not # handled during a maintenance window. # - After the new group is healthy, update your applications to use the new # primary endpoint (aws_elasticache_replication_group.encrypted.primary_endpoint_address), # then delete the old replication group (either via Terraform if it is managed # there, or manually/CLI otherwise). # VERIFICATION: # `terraform plan` should show: # - 1 to add: aws_elasticache_snapshot.migration # - 1 to add: aws_elasticache_replication_group.encrypted # - (Optionally) 1 to destroy: the old, unencrypted aws_elasticache_replication_group # if it is currently managed in your Terraform and you removed/renamed it. ```