> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Enable In-Transit Encryption for Redis Cache Servers ### More Info: Ensure that in-transit encryption is enabled for all Microsoft Azure Redis Cache servers. ### Risk Level High ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * FedRAMP * GDPR * HIPAA * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate the misconfiguration of enabling in-transit encryption for Redis Cache Servers in Azure: 1. Login to your Azure portal and navigate to the Redis Cache Server that needs to be remediated. 2. Click on the "Configuration" tab from the left-hand side menu. 3. Scroll down to the "Security" section and click on the "Edit" button. 4. Under the "Transport Security Settings" section, select the "Enable SSL" option. 5. Click on the "Save" button to save the changes. 6. Once the changes are saved, the Redis Cache Server will be configured to use in-transit encryption using SSL. 7. Verify the changes by connecting to the Redis Cache Server using a Redis client and checking if the connection is encrypted using SSL. That's it! You have successfully remediated the misconfiguration of enabling in-transit encryption for Redis Cache Servers in Azure using the Azure console. # To enable In-Transit Encryption for Redis Cache Servers in AZURE using AZURE CLI, follow these steps: 1. Open the Azure CLI on your local machine or Azure Cloud Shell. 2. Login to your Azure account using the command: ``` az login ``` 3. Select the subscription you want to work with using the command: ``` az account set --subscription ``` 4. Check the current encryption status of your Redis Cache Server using the command: ``` az redis show --name --resource-group --query 'enableNonSslPort' ``` If the output is "true", it means that In-Transit Encryption is not enabled. 5. Enable In-Transit Encryption for Redis Cache Server using the command: ``` az redis update --name --resource-group --enable-non-ssl-port false ``` This will disable non-SSL port and enable In-Transit Encryption for Redis Cache Server. 6. Verify the encryption status again using the command: ``` az redis show --name --resource-group --query 'enableNonSslPort' ``` The output should be "false", indicating that In-Transit Encryption is now enabled for Redis Cache Server. That's it! You have successfully remediated the misconfiguration by enabling In-Transit Encryption for Redis Cache Server in AZURE using AZURE CLI. To enable in-transit encryption for Redis Cache servers in AZURE using Python, you can follow the below steps: 1. Import the required libraries: ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.redis import RedisManagementClient from azure.mgmt.redis.models import RedisAccessKeys, RedisUpdateParameters ``` 2. Authenticate and create a Redis Cache Management Client: ```python theme={null} credential = DefaultAzureCredential() redis_client = RedisManagementClient(credential, subscription_id) ``` 3. Get the Redis Cache instance: ```python theme={null} redis_instance = redis_client.redis.get(resource_group_name, redis_cache_name) ``` 4. Update the Redis Cache instance to enable in-transit encryption: ```python theme={null} redis_instance.enable_non_ssl_port = False redis_instance.minimum_tls_version = '1.2' redis_instance.tls_port = 6380 redis_instance.redis_configuration['requirepass'] = 'your_redis_password' redis_update_params = RedisUpdateParameters(enable_non_ssl_port=False, minimum_tls_version='1.2', tls_port=6380, redis_configuration={'requirepass': 'your_redis_password'}) redis_client.redis.update(resource_group_name, redis_cache_name, redis_update_params) ``` Note: Replace `subscription_id`, `resource_group_name`, `redis_cache_name`, and `your_redis_password` with the actual values. This will enable in-transit encryption for the Redis Cache instance in AZURE. ```hcl theme={null} resource "azurerm_redis_cache" "redis_secure" { name = "REDIS_CACHE_NAME" # e.g. "prod-redis-cache" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name sku_name = "SKU_FAMILY" # e.g. "Basic" capacity = REDIS_CAPACITY # e.g. 1 family = "C" shard_count = 0 # Enable in-transit encryption by allowing only TLS/SSL connections enable_non_ssl_port = false # (Recommended) enforce modern TLS minimum_tls_version = "1.2" # ...any other required arguments (subnet_id, redis_configuration, etc.) } ``` Setting `enable_non_ssl_port = false` may force replacement of the Redis cache instance, causing a brief outage; plan and schedule accordingly. To verify, `terraform plan` should show the Redis resource being created or updated with `enable_non_ssl_port = false` (and optionally `minimum_tls_version = "1.2"`) and no remaining diff for in‑transit encryption.