AWS › Amazon ElastiCache (Redis & Memcached)

How can ElastiCache be secured within a VPC, and what encryption options are available?

Advanced

Answer

ElastiCache clusters are deployed within a VPC and can be restricted using security groups so only specific application servers or subnets can connect, and Redis clusters additionally support encryption in transit using TLS and encryption at rest for stored data, along with Redis AUTH tokens that require a password before any client can execute commands against the cluster.

aws elasticache create-replication-group --replication-group-id secure-cache --engine redis --transit-encryption-enabled --at-rest-encryption-enabled --auth-token 'MySecurePassword123'

Real-world example A healthcare application enables both encryption in transit and encryption at rest on its Redis cluster, along with an AUTH token requirement, satisfying strict compliance requirements for handling sensitive patient session data.

Common follow-ups: Does Memcached support the same encryption features as Redis?;How do you rotate a Redis AUTH token without downtime?

VPC & Networking;AWS KMS & Data Encryption