AWS ElastiCache for Redis is a managed service that removes the operational burden of running Redis on your own. Terraform provides infrastructure as code to provision ElastiCache clusters with repeatable, versioned configurations. This article covers production-ready patterns for securing ElastiCache Redis with Terraform, including encryption, network isolation, authentication, and module usage, using only the concrete details available in the reference material.
The tutorial focused on security emphasizes encryption at rest and in transit, network access restrictions, IAM integration and authentication for access control, creation of three default users for authorization, a Terraform script example for deploying Redis, and a Python script example for interacting with Redis. Single-node versus cluster deployment and high availability are explicitly excluded from that tutorial.
Why ElastiCache Instead of Self-Managed Redis
Managed ElastiCache shifts operational responsibility to AWS.
- AWS automatically handles security patches, encryption, and monitoring
- Provides IAM-based access control and automated backups
- Supports VPC and Security Groups for network isolation
Amazon ElastiCache gives you managed Redis or Memcached clusters, handling the infrastructure, patching, and failover so you can focus on your application. In practice, the service is used for both Redis, which is far more popular, and Memcached, along with production configurations for encryption, replication, and automatic failover.
Encryption Foundations for Redis
AWS ElastiCache for Redis provides two key types of encryption to enhance security.
Encryption at Rest protects data stored on disk, including backups, snapshots, and swap files. It uses AES-256 encryption. Data is automatically encrypted when stored in AWS. It is enabled via:
at_rest_encryption_enabled = true
Encryption in transit protects data moving between client and node. The cloudposse Terraform module for ElastiCache Redis uses secure defaults. One of the ways this module can trip users up is with transitencryptionenabled which is true by default. With this enabled, one does not simply redis-cli in without setting up an stunnel. Amazon provides good documentation on how to connect with it enabled. If this is not desired behavior, set transitencryptionenabled=false.
The module creates, by default, a new security group for the Elasticache Redis Cluster or Serverless Instance. When a configuration change, for example a different security group name, cannot be applied to the security group, Terraform will replace that security group with a new one with the new configuration. In order to allow Terraform to fully manage the security group, you should not place any other resources in, or associate any other resources with, the security group this module creates. Also, in order to keep things from breaking when the module replaces the security group, you should not reference the created security group anywhere else, such as in rules in other security groups.
Disruptive changes were introduced at version 0.41.0. If upgrading from an earlier version, see migration notes for details.
Networking Prerequisites and Isolation
ElastiCache runs in your VPC and needs a subnet group and security group.
A subnet group for ElastiCache:
resource "aws_elasticache_subnet_group" "main" {
name = "cache-subnet-group"
subnet_ids = var.private_subnet_ids
tags = {
ManagedBy = "terraform"
}
}
A security group for ElastiCache:
resource "aws_security_group" "cache" {
name_prefix = "cache-"
vpc_id = var.vpc_id
description = "Security group for ElastiCache"
ingress {
from_port = 6379
to_port = 6379
protocol = "tcp"
security_groups = [var.app_security_group_id]
description = "Redis from application"
}
ingress {
from_port = 11211
to_port = 11211
protocol = "tcp"
security_groups = [var.app_security_group_id]
description = "Memcached from application"
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
lifecycle {
create_before_destroy = true
}
}
The cluster will be secured using the custom security group, which controls access to the Redis instance. The tutorial notes a security group that allows inbound traffic on the Redis default port 6379.
resource "aws_security_group" "redis_sg" {
name = "redis-security-group"
description = "Security group for Redis cluster"
ingress {
from_port = 6379
to_port = 6379
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"] # Open to all; consider restricting to specific IPs for better security
}
}
Once the cluster is up and running, you can access it via the endpoint provided in the AWS Management Console or through the Terraform output if configured. Ensure your security group is properly configured to allow access from your application or other clients.
Core Terraform Configuration Patterns
Terraform simplifies the process of managing AWS resources by treating infrastructure as code. Before you start, ensure you have the following:
- AWS Account: An active AWS account with the necessary permissions
- Terraform Installed: Terraform should be installed and configured on your local machine
- AWS Access Key and Secret Key: You'll need these to authenticate Terraform with AWS
Start by defining the AWS provider. This configuration tells Terraform to interact with AWS resources in the specified region using your credentials.
provider "aws" {
region = "ap-southeast-2"
access_key = "your-access-key" # Replace with your actual AWS access key
secret_key = "your-secret-key" # Replace with your actual AWS secret key
}
Next, create a security group to control network access to your Redis cluster. This security group will allow inbound traffic on the Redis default port, 6379.
Now define the ElastiCache Redis cluster.
resource "aws_elasticache_cluster" "redis_dev" {
cluster_id = "myapp-cache-dev"
engine = "redis"
engine_version =
Simple Redis Cluster for development or simple caching needs:
resource "aws_elasticache_cluster" "redis_dev" {
cluster_id = "myapp-cache-dev"
engine = "redis"
engine_version = "7.0"
parameter_group_name = "default.redis7"
engine_version = "7.0"
apply_immediately = true
port = 6379
security_group_ids = [aws_security_group.redis_sg.id]
}
With your Terraform configuration ready, follow these steps to deploy the Redis cluster on AWS:
- Initialize Terraform:
terraform init - Create an Execution Plan:
terraform plan - Apply the Plan:
terraform apply
This will create the ElastiCache Redis cluster as specified in your Terraform configuration.
If you no longer need the Redis cluster and want to avoid incurring costs, you can destroy the resources created by Terraform:
terraform destroy
This command will delete the Redis cluster and associated resources, such as the security group, from your AWS account.
Using Terraform to create an AWS ElastiCache Redis cluster streamlines the process of setting up and managing your infrastructure. By defining your cluster and its associated resources in a Terraform configuration file, you can easily recreate, modify, and destroy your infrastructure as needed. This approach ensures consistency, repeatability, and version control for your cloud resources.
For production environments, consider adding more advanced features such as Redis replication, backup configurations, and enhanced security rules. Terraform's flexibility allows you to manage these aspects efficiently within your infrastructure-as-code workflow.
Module Parameters and Options
The Terraform AWS ElastiCache module exposes a large set of parameters for production use.
| Parameter | Description | Type | Default | Required |
|---|---|---|---|---|
| parametergroupfamily | The family of the ElastiCache parameter group | string | "" | no |
| parametergroupname | The name of the parameter group. If createparametergroup is true, this is the name assigned to the parameter group created. Otherwise, this is the name of an existing parameter group | string | null | no |
| parameters | List of ElastiCache parameters to apply | list(map(string)) | [] | no |
| port | The port number on which each of the cache nodes will accept connections. For Memcached the default is 11211, and for Redis the default port is 6379 | number | null | no |
| preferredavailabilityzones | List of the Availability Zones in which cache nodes are created | list(string) | [] | no |
| preferredcachecluster_azs | List of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is considered. The first item in the list will be the primary node. Ignored when updating | list(string) | [] | no |
| preferredoutpostarn | The outpost ARN in which the cache cluster will be created | string | null | no |
| replicaspernode_group | Number of replica nodes in each node group. Changing this number will trigger a resizing operation before other settings modifications. Valid values are 0 to 5 | number | null | no |
| replicationgroupid | Replication group identifier |
The module defaults to Managed by Terraform for tagging. The module creates, by default, a new security group for the Elasticache Redis Cluster or Serverless Instance.
Security Best Practices in Practice
The security-focused tutorial guides you through the following Redis security features:
- Encryption at rest and in transit
- Network access restrictions
- IAM integration and authentication for access control
- Creation of three default users for authorization
- Terraform script example for deploying Redis
- Python script example for interacting with Redis
Encryption at rest protects data stored on disk. Uses AES-256 encryption. Automatically encrypts data when stored in AWS. Enabled via atrestencryption_enabled = true.
Network isolation is achieved through VPC placement, subnet groups limited to private subnets, and security groups that allow only application security groups to reach ports 6379 for Redis and 11211 for Memcached.
Authentication can be enforced with IAM integration and Redis users. The tutorial covers creation of three default users for authorization.
Operational Workflow
The standard Terraform lifecycle applies to ElastiCache provisioning.
- Initialize Terraform
terraform init - Create an Execution Plan
terraform plan - Apply the Plan
terraform apply
Destruction is explicit.
terraform destroy
This will delete the Redis cluster and associated resources, such as the security group, from your AWS account.
Conclusion
Conclusion
Provisioning AWS ElastiCache Redis with Terraform requires explicit attention to encryption, network isolation, and module defaults. Encryption at rest with AES-256 is enabled via atrestencryptionenabled, and encryption in transit is on by default in the cloudposse module via transitencryptionenabled, which changes connectivity requirements. Subnet groups and security groups must be defined before the cluster, with ingress limited to application security groups on port 6379 for Redis and 11211 for Memcached. Provider configuration, security group definition, and cluster definition form the minimal deployable unit, with engineversion 7.0 and parametergroupname default.redis7 shown as a concrete example. Module usage introduces parametergroupfamily, parameters, port, preferredavailabilityzones, replicaspernodegroup, and replicationgroup_id for production shaping, and carries the warning that security group replacement will break references if the created security group is used elsewhere. The workflow of init, plan, apply, and destroy provides repeatable infrastructure with version control, while IAM-based access control and user authorization complete the security posture described in the reference material.