AWS ElastiCache Cluster

aws_elasticache_cluster (Terraform)

The Cluster in ElastiCache can be configured in Terraform with the resource name aws_elasticache_cluster. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

storebot/pr_demo_flat

resource "aws_elasticache_cluster" "noMemcachedInElastiCache" {
  cluster_id           = "cluster-example"
  engine               = "memcached"
  node_type            = "cache.m4.large"
  num_cache_nodes      = 2
  parameter_group_name = "default.memcached1.4"

melscoop-test/check

resource "aws_elasticache_cluster" "enabled" {
  cluster_id           = "cluster"
  engine               = "redis"
  node_type            = "cache.m5.large"
  num_cache_nodes      = 1
  parameter_group_name = "default.redis6.x"

gilyas/infracost

resource "aws_elasticache_cluster" "memcached" {
  cluster_id           = "cluster-example"
  engine               = "memcached"
  node_type            = "cache.m4.large"
  num_cache_nodes      = 2
  parameter_group_name = "default.redis3.2"

SnidermanIndustries/checkov-fork

resource "aws_elasticache_cluster" "enabled" {
  cluster_id           = "cluster"
  engine               = "redis"
  node_type            = "cache.m5.large"
  num_cache_nodes      = 1
  parameter_group_name = "default.redis6.x"

bridgecrewio/checkov

resource "aws_elasticache_cluster" "enabled" {
  cluster_id           = "cluster"
  engine               = "redis"
  node_type            = "cache.m5.large"
  num_cache_nodes      = 1
  parameter_group_name = "default.redis6.x"

Security Best Practices for aws_elasticache_cluster

There is 1 setting in aws_elasticache_cluster that should be taken care of for security reasons. The following section explain an overview and example code.

Ensure to enable backup retention of Elasitcache

It's better to take snapshots of Redis clusters to improve data availability.

Parameters

• apply_immediately optional computed - bool
• arn optional computed - string
• availability_zone optional computed - string
• az_mode optional computed - string
• cache_nodes optional computed - list of object
  • address - string
  • availability_zone - string
  • id - string
  • port - number
• cluster_address optional computed - string
• cluster_id required - string
• configuration_endpoint optional computed - string
• engine optional computed - string
• engine_version optional computed - string
• final_snapshot_identifier optional - string
• id optional computed - string
• maintenance_window optional computed - string
• node_type optional computed - string
• notification_topic_arn optional - string
• num_cache_nodes optional computed - number
• parameter_group_name optional computed - string
• port optional computed - number
• preferred_availability_zones optional - list of string
• replication_group_id optional computed - string
• security_group_ids optional computed - set of string
• security_group_names optional computed - set of string
• snapshot_arns optional - list of string
• snapshot_name optional - string
• snapshot_retention_limit optional - number
• snapshot_window optional computed - string
• subnet_group_name optional computed - string
• tags optional - map from string to string

Explanation in Terraform Registry

Provides an ElastiCache Cluster resource, which manages either a Memcached cluster, a single-node Redis instance, or a [read replica in a Redis (Cluster Mode Enabled) replication group]. For working with Redis (Cluster Mode Enabled) replication groups, see the aws_elasticache_replication_group resource.

Note: When you change an attribute, such as num_cache_nodes, by default it is applied in the next maintenance window. Because of this, Terraform may report a difference in its planning phase because the actual modification has not yet taken place. You can use the apply_immediately flag to instruct the service to apply the change immediately. Using apply_immediately can result in a brief downtime as the server reboots. See the AWS Documentation on Modifying an ElastiCache Cache Cluster for ElastiCache for Memcached or ElastiCache for Redis for more information. Note: Any attribute changes that re-create the resource will be applied immediately, regardless of the value of apply_immediately.

Tips: Best Practices for The Other AWS ElastiCache Resources

In addition to the aws_elasticache_replication_group, AWS ElastiCache has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

aws_elasticache_replication_group

Ensure to enable in-transit encryption of ElastiCache

It's better to enable in-transit encryption of ElastiCahe. If the ElastiCache replication group uses unencrypted traffic, it is vulnerable to meet-in-the-middle (MITM) attacks.