AWS ElastiCache Replication Group

aws_elasticache_replication_group (Terraform)

The Replication Group in ElastiCache can be configured in Terraform with the resource name aws_elasticache_replication_group. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

SonarSource/sonar-iac

resource "aws_elasticache_replication_group" "missing_property" {
}

resource "aws_elasticache_replication_group" "sensitive_proprty_value" {
  transit_encryption_enabled = false  # Noncompliant {{Make sure allowing clear-text traffic is safe here.}}
}

gilyas/infracost

resource "aws_elasticache_replication_group" "cluster" {
  replication_group_description = "This Replication Group"
  replication_group_id          = "tf-rep-group-1"
  automatic_failover_enabled    = true
  node_type                     = "cache.m4.large"

guilhermeghm/terraform_scripts

resource "aws_elasticache_replication_group" "ec-single" {
  replication_group_id          = "ec-single"
  replication_group_description = "Cluster single node"
  node_type                     = "cache.t3.micro"
  number_cache_clusters         = 1
  port                          = 6379

infracost/infracost

resource "aws_elasticache_replication_group" "cluster" {
  replication_group_description = "This Replication Group"
  replication_group_id          = "tf-rep-group-1"
  automatic_failover_enabled    = true
  node_type                     = "cache.m4.large"

stelligent/config-lint

resource "aws_elasticache_replication_group" "transit_encryption_enabled_is_set_to_true" {
  replication_group_id          = "foo"
  replication_group_description = "test description"
  node_type                     = "cache.m4.large"
  number_cache_clusters         = 2
  transit_encryption_enabled    = true

Security Best Practices for aws_elasticache_replication_group

There are 2 settings in aws_elasticache_replication_group that should be taken care of for security reasons. The following section explain an overview and example code.

Ensure to enable in-transit encryption of ElastiCache

It's better to enable in-transit encryption of ElastiCahe. If the ElastiCache replication group uses unencrypted traffic, it is vulnerable to meet-in-the-middle (MITM) attacks.

Enable at rest encryption of ElastiCache

It is better to enable at rest encryption of ElastiCache. Encryption reduces the risk of data leakage.

Parameters

• apply_immediately optional computed - bool
• arn optional computed - string
• at_rest_encryption_enabled optional computed - bool
• auth_token optional - string
• auto_minor_version_upgrade optional - bool
• automatic_failover_enabled optional - bool
• availability_zones optional - set of string
• cluster_enabled optional computed - bool
• configuration_endpoint_address optional computed - string
• engine optional - string
• engine_version optional computed - string
• final_snapshot_identifier optional - string
• global_replication_group_id optional computed - string
• id optional computed - string
• kms_key_id optional - string
• maintenance_window optional computed - string
• member_clusters optional computed - set of string
• multi_az_enabled optional - bool
• node_type optional computed - string
• notification_topic_arn optional - string
• number_cache_clusters optional computed - number
• parameter_group_name optional computed - string
• port optional - number
• primary_endpoint_address optional computed - string
• reader_endpoint_address optional computed - string
• replication_group_description required - string
• replication_group_id required - string
• security_group_ids optional computed - set of string
• security_group_names optional computed - set of string
• snapshot_arns optional - set of string
• snapshot_name optional - string
• snapshot_retention_limit optional - number
• snapshot_window optional computed - string
• subnet_group_name optional computed - string
• tags optional - map from string to string
• transit_encryption_enabled optional computed - bool
• cluster_mode list block
  • num_node_groups required - number
  • replicas_per_node_group required - number
• timeouts single block
  • create optional - string
  • delete optional - string
  • update optional - string

Explanation in Terraform Registry

Provides an ElastiCache Replication Group resource. For working with a Memcached cluster or a single-node Redis instance (Cluster Mode Disabled), see the aws_elasticache_cluster resource.

Note: When you change an attribute, such as engine_version, by default the ElastiCache API applies it in the next maintenance window. Because of this, Terraform may report a difference in its planning phase because the actual modification has not yet taken place. You can use the apply_immediately flag to instruct the service to apply the change immediately. Using apply_immediately can result in a brief downtime as servers reboots. See the AWS Documentation on Modifying an ElastiCache Cache Cluster for more information. Note: Any attribute changes that re-create the resource will be applied immediately, regardless of the value of apply_immediately. Note: Be aware of the terminology collision around "cluster" for aws_elasticache_replication_group. For example, it is possible to create a "Cluster Mode Disabled [Redis] Cluster". With "Cluster Mode Enabled", the data will be stored in shards (called "node groups"). See Redis Cluster Configuration for a diagram of the differences. To enable cluster mode, use a parameter group that has cluster mode enabled. The default parameter groups provided by AWS end with ".cluster.on", for example default.redis6.x.cluster.on.

Tips: Best Practices for The Other AWS ElastiCache Resources

In addition to the aws_elasticache_cluster, AWS ElastiCache has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

aws_elasticache_cluster

Ensure to enable backup retention of Elasitcache

It's better to take snapshots of Redis clusters to improve data availability.