AWS ElastiCache Replication Group
This page shows how to write Terraform and CloudFormation for ElastiCache Replication Group and write them securely.
aws_elasticache_replication_group (Terraform)
The Replication Group in ElastiCache can be configured in Terraform with the resource name aws_elasticache_replication_group
. The following sections describe 5 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "aws_elasticache_replication_group" "missing_property" {
}
resource "aws_elasticache_replication_group" "sensitive_proprty_value" {
transit_encryption_enabled = false # Noncompliant {{Make sure allowing clear-text traffic is safe here.}}
}
resource "aws_elasticache_replication_group" "cluster" {
replication_group_description = "This Replication Group"
replication_group_id = "tf-rep-group-1"
automatic_failover_enabled = true
node_type = "cache.m4.large"
resource "aws_elasticache_replication_group" "ec-single" {
replication_group_id = "ec-single"
replication_group_description = "Cluster single node"
node_type = "cache.t3.micro"
number_cache_clusters = 1
port = 6379
resource "aws_elasticache_replication_group" "cluster" {
replication_group_description = "This Replication Group"
replication_group_id = "tf-rep-group-1"
automatic_failover_enabled = true
node_type = "cache.m4.large"
resource "aws_elasticache_replication_group" "transit_encryption_enabled_is_set_to_true" {
replication_group_id = "foo"
replication_group_description = "test description"
node_type = "cache.m4.large"
number_cache_clusters = 2
transit_encryption_enabled = true
Security Best Practices for aws_elasticache_replication_group
There are 2 settings in aws_elasticache_replication_group that should be taken care of for security reasons. The following section explain an overview and example code.
Ensure to enable in-transit encryption of ElastiCache
It's better to enable in-transit encryption of ElastiCahe. If the ElastiCache replication group uses unencrypted traffic, it is vulnerable to meet-in-the-middle (MITM) attacks.
Enable at rest encryption of ElastiCache
It is better to enable at rest encryption of ElastiCache. Encryption reduces the risk of data leakage.
Parameters
-
apply_immediately
optional computed - bool -
arn
optional computed - string -
at_rest_encryption_enabled
optional computed - bool -
auth_token
optional - string -
auto_minor_version_upgrade
optional - bool -
automatic_failover_enabled
optional - bool -
availability_zones
optional - set of string -
cluster_enabled
optional computed - bool -
configuration_endpoint_address
optional computed - string -
engine
optional - string -
engine_version
optional computed - string -
final_snapshot_identifier
optional - string -
global_replication_group_id
optional computed - string -
id
optional computed - string -
kms_key_id
optional - string -
maintenance_window
optional computed - string -
member_clusters
optional computed - set of string -
multi_az_enabled
optional - bool -
node_type
optional computed - string -
notification_topic_arn
optional - string -
number_cache_clusters
optional computed - number -
parameter_group_name
optional computed - string -
port
optional - number -
primary_endpoint_address
optional computed - string -
reader_endpoint_address
optional computed - string -
replication_group_description
required - string -
replication_group_id
required - string -
security_group_ids
optional computed - set of string -
security_group_names
optional computed - set of string -
snapshot_arns
optional - set of string -
snapshot_name
optional - string -
snapshot_retention_limit
optional - number -
snapshot_window
optional computed - string -
subnet_group_name
optional computed - string -
tags
optional - map from string to string -
transit_encryption_enabled
optional computed - bool -
cluster_mode
list block-
num_node_groups
required - number -
replicas_per_node_group
required - number
-
-
timeouts
single block
Explanation in Terraform Registry
Provides an ElastiCache Replication Group resource. For working with a Memcached cluster or a single-node Redis instance (Cluster Mode Disabled), see the
aws_elasticache_cluster
resource.Note: When you change an attribute, such as
engine_version
, by default the ElastiCache API applies it in the next maintenance window. Because of this, Terraform may report a difference in its planning phase because the actual modification has not yet taken place. You can use theapply_immediately
flag to instruct the service to apply the change immediately. Usingapply_immediately
can result in a brief downtime as servers reboots. See the AWS Documentation on Modifying an ElastiCache Cache Cluster for more information. Note: Any attribute changes that re-create the resource will be applied immediately, regardless of the value ofapply_immediately
. Note: Be aware of the terminology collision around "cluster" foraws_elasticache_replication_group
. For example, it is possible to create a "Cluster Mode Disabled [Redis] Cluster". With "Cluster Mode Enabled", the data will be stored in shards (called "node groups"). See Redis Cluster Configuration for a diagram of the differences. To enable cluster mode, use a parameter group that has cluster mode enabled. The default parameter groups provided by AWS end with ".cluster.on", for exampledefault.redis6.x.cluster.on
.
Tips: Best Practices for The Other AWS ElastiCache Resources
In addition to the aws_elasticache_cluster, AWS ElastiCache has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
aws_elasticache_cluster
Ensure to enable backup retention of Elasitcache
It's better to take snapshots of Redis clusters to improve data availability.
AWS::ElastiCache::ReplicationGroup (CloudFormation)
The ReplicationGroup in ElastiCache can be configured in CloudFormation with the resource name AWS::ElastiCache::ReplicationGroup
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
-
AtRestEncryptionEnabled
optional - Boolean -
AuthToken
optional - String -
AutoMinorVersionUpgrade
optional - Boolean -
AutomaticFailoverEnabled
optional - Boolean -
CacheNodeType
optional - String -
CacheParameterGroupName
optional - String -
CacheSecurityGroupNames
optional - List -
CacheSubnetGroupName
optional - String -
Engine
optional - String -
EngineVersion
optional - String -
GlobalReplicationGroupId
optional - String -
KmsKeyId
optional - String -
LogDeliveryConfigurations
optional - List of LogDeliveryConfigurationRequest -
MultiAZEnabled
optional - Boolean -
NodeGroupConfiguration
optional - List of NodeGroupConfiguration -
NotificationTopicArn
optional - String -
NumCacheClusters
optional - Integer -
NumNodeGroups
optional - Integer -
Port
optional - Integer -
PreferredCacheClusterAZs
optional - List -
PreferredMaintenanceWindow
optional - String -
PrimaryClusterId
optional - String -
ReplicasPerNodeGroup
optional - Integer -
ReplicationGroupDescription
required - String -
ReplicationGroupId
optional - String -
SecurityGroupIds
optional - List -
SnapshotArns
optional - List -
SnapshotName
optional - String -
SnapshotRetentionLimit
optional - Integer -
SnapshotWindow
optional - String -
SnapshottingClusterId
optional - String -
Tags
optional - List of Tag -
TransitEncryptionEnabled
optional - Boolean -
UserGroupIds
optional - List
Explanation in CloudFormation Registry
The
AWS::ElastiCache::ReplicationGroup
resource creates an Amazon ElastiCache Redis replication group. A Redis (cluster mode disabled) replication group is a collection of cache clusters, where one of the clusters is a primary read-write cluster and the others are read-only replicas. A Redis (cluster mode enabled) cluster is comprised of from 1 to 90 shards (API/CLI: node groups). Each shard has a primary node and up to 5 read-only replica nodes. The configuration can range from 90 shards and 0 replicas to 15 shards and 5 replicas, which is the maximum number or replicas allowed. The node or shard limit can be increased to a maximum of 500 per cluster if the Redis engine version is 5.6 or higher. For example, you can choose to configure a 500 node cluster that ranges between 83 shards (one primary and 5 replicas per shard) and 500 shards (single primary and no replicas). Make sure there are enough available IP addresses to accommodate the increase. Common pitfalls include the subnets in the subnet group have too small a CIDR range or the subnets are shared and heavily used by other clusters. For more information, see Creating a Subnet Group. For versions below 5.
6, the limit is 250 per cluster.
To request a limit increase, see Amazon Service Limits and choose the limit type Nodes per cluster per instance type.
Frequently asked questions
What is AWS ElastiCache Replication Group?
AWS ElastiCache Replication Group is a resource for ElastiCache of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.
Where can I find the example code for the AWS ElastiCache Replication Group?
For Terraform, the SonarSource/sonar-iac, gilyas/infracost and guilhermeghm/terraform_scripts source code examples are useful. See the Terraform Example section for further details.