Enable In-Transit Encryption for Redis Cache Servers

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of enabling in-transit encryption for Redis Cache Servers in Azure:

Login to your Azure portal and navigate to the Redis Cache Server that needs to be remediated.
Click on the “Configuration” tab from the left-hand side menu.
Scroll down to the “Security” section and click on the “Edit” button.
Under the “Transport Security Settings” section, select the “Enable SSL” option.
Click on the “Save” button to save the changes.
Once the changes are saved, the Redis Cache Server will be configured to use in-transit encryption using SSL.
Verify the changes by connecting to the Redis Cache Server using a Redis client and checking if the connection is encrypted using SSL.

That’s it! You have successfully remediated the misconfiguration of enabling in-transit encryption for Redis Cache Servers in Azure using the Azure console.

Using CLI

To enable In-Transit Encryption for Redis Cache Servers in AZURE using AZURE CLI, follow these steps:

Open the Azure CLI on your local machine or Azure Cloud Shell.
Login to your Azure account using the command:
az login
Select the subscription you want to work with using the command:
az account set --subscription <subscription_id>
Check the current encryption status of your Redis Cache Server using the command:
az redis show --name <redis_server_name> --resource-group <resource_group_name> --query 'enableNonSslPort'
If the output is “true”, it means that In-Transit Encryption is not enabled.
Enable In-Transit Encryption for Redis Cache Server using the command:
az redis update --name <redis_server_name> --resource-group <resource_group_name> --enable-non-ssl-port false
This will disable non-SSL port and enable In-Transit Encryption for Redis Cache Server.
Verify the encryption status again using the command:
az redis show --name <redis_server_name> --resource-group <resource_group_name> --query 'enableNonSslPort'
The output should be “false”, indicating that In-Transit Encryption is now enabled for Redis Cache Server.

That’s it! You have successfully remediated the misconfiguration by enabling In-Transit Encryption for Redis Cache Server in AZURE using AZURE CLI.

Using Python

To enable in-transit encryption for Redis Cache servers in AZURE using Python, you can follow the below steps:

Import the required libraries:

from azure.identity import DefaultAzureCredential
from azure.mgmt.redis import RedisManagementClient
from azure.mgmt.redis.models import RedisAccessKeys, RedisUpdateParameters

Authenticate and create a Redis Cache Management Client:

credential = DefaultAzureCredential()
redis_client = RedisManagementClient(credential, subscription_id)

Get the Redis Cache instance:

redis_instance = redis_client.redis.get(resource_group_name, redis_cache_name)

Update the Redis Cache instance to enable in-transit encryption:

redis_instance.enable_non_ssl_port = False
redis_instance.minimum_tls_version = '1.2'
redis_instance.tls_port = 6380
redis_instance.redis_configuration['requirepass'] = 'your_redis_password'
redis_update_params = RedisUpdateParameters(enable_non_ssl_port=False, minimum_tls_version='1.2', tls_port=6380, redis_configuration={'requirepass': 'your_redis_password'})
redis_client.redis.update(resource_group_name, redis_cache_name, redis_update_params)

Note: Replace subscription_id, resource_group_name, redis_cache_name, and your_redis_password with the actual values.This will enable in-transit encryption for the Redis Cache instance in AZURE.

Using Terraform

resource "azurerm_redis_cache" "redis_secure" {
  name                = "REDIS_CACHE_NAME"          # e.g. "prod-redis-cache"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku_name            = "SKU_FAMILY"                # e.g. "Basic"
  capacity            = REDIS_CAPACITY              # e.g. 1
  family              = "C"
  shard_count         = 0

  # Enable in-transit encryption by allowing only TLS/SSL connections
  enable_non_ssl_port = false

  # (Recommended) enforce modern TLS
  minimum_tls_version = "1.2"

  # ...any other required arguments (subnet_id, redis_configuration, etc.)
}

Setting enable_non_ssl_port = false may force replacement of the Redis cache instance, causing a brief outage; plan and schedule accordingly.To verify, terraform plan should show the Redis resource being created or updated with enable_non_ssl_port = false (and optionally minimum_tls_version = "1.2") and no remaining diff for in‑transit encryption.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Enable In-Transit Encryption for Redis Cache Servers

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​