Amazon ElastiCache is a web service that allows for deploying, operating, and scaling an in-memory data store or cache and is often used to improve application performance by reading from a fast in-memory data store instead of a slower disk-based database. Currently, Elasticache supports two different engines:
- Redis
- Memcached
ElastiCache gives you managed Redis or Memcached clusters, handling the infrastructure, patching, and failover so you can focus on your application. ElastiCache Redis can be deployed via the AWS Console, AWS SDK, Amazon ElastiCache API, AWS CloudFormation and through deployment tools like HashiCorp Terraform. Developers continue to pick Redis as their favorite NoSQL data store Stack Overflow Developer Survey 2017 and Amazon ElastiCache provides an easy, fast, and highly available Redis on AWS.
Infrastructure as Code provides a systematic approach to managing deployments, enabling version control, peer reviews, and automated deployments. For ElastiCache for Valkey, IaC ensures critical security configurations like encryption keys, network isolation, and authentication tokens are consistently applied across development, staging, and production environments. This approach transforms the infrastructure provisioning process into a reliable, repeatable pattern that scales with your organization’s needs.
Getting Started with the HashiCorp Example Project
The HashiCorp repository examines how to manage AWS ElastiCache with HashiCorp Terraform. This repository examines how to manage AWS ElastiCache with HashiCorp Terraform.
To create the cluster clone of the repository at https://github.com/hashicorp/terraform-elasticache-example to get the example Terraform project.
bash
$ git clone https://github.com/hashicorp/terraform-elasticache-example.git
$ cd terraform-elasticache-example
Before running terraform plan
and terraform apply
,set a few environment variables with your AWS account details, for more information on using Terraform with AWS please take a look at this post Terraform: Beyond the Basics with AWS | AWS Partner Network (APN) Blog
bash
export AWS_ACCESS_KEY_ID=[AWS ACCESS KEY ID]
export AWS_SECRET_ACCESS_KEY=[AWS SECRET ACCESS KEY]
export AWS_REGION=[AWS REGION, e.g
The example project is designed to create the following instances:
- 6x ElastiCache nodes (cache.m4.large)
- 1x SSH host (t2.nano)
We need to create an SSH host because the cluster is not accessible from the public internet, this will be attached to the same VPC so that we can test the cluster, this instance is fulfilling the role of your application server.
ElastiCache Deployment Options in Terraform
The terraform-aws-elasticache module enables infrastructure-as-code creation and management of AWS ElastiCache resources. The module supports multiple deployment types including Memcached clusters, Redis/Valkey clusters, replication groups, and serverless cache deployments.
The terraform-aws-elasticache module is designed to simplify the provisioning and management of AWS ElastiCache resources through Terraform.
The module offers the following key capabilities:
The AWS ElastiCache Terraform module consists of several integrated components that work together to create and manage ElastiCache resources.
The module can create standalone ElastiCache clusters, primarily used for Memcached deployments or single-node Redis deployments.
hcl
resource "aws_elasticache_cluster" "redis_dev"
Key configuration options:
For Redis/Valkey deployments requiring high availability or read scaling, the module creates replication groups with primary and replica nodes.
hcl
aws_elasticache_replication_group
Key configuration options:
For multi-region Redis deployments, the module supports creating global replication groups.
hcl
aws_elasticache_global_replication_group
This allows:
hcl
aws_elasticache_parameter_group
Customizes the behavior of the ElastiCache engine through configurable parameters.
hcl
aws_elasticache_subnet_group
Specifies the VPC subnets where ElastiCache nodes are deployed.
hcl
aws_security_group
aws_vpc_security_group_ingress_rule
aws_vpc_security_group_egress_rule
Manages network access to ElastiCache resources.
The module provides a consistent interface for creating various ElastiCache deployment types while handling the underlying complexity of resource configurations, security settings, parameter groups, and networking requirements.
For detailed information about specific deployment patterns, see Example Deployments.
Networking Prerequisites for ElastiCache
ElastiCache runs in your VPC and needs a subnet group and security group.
hcl
resource "aws_elasticache_subnet_group" "main" {
name = "cache-subnet-group"
subnet_ids = var.private_subnet_ids
tags = {
ManagedBy = "terraform"
}
}
hcl
resource "aws_security_group" "cache" {
name_prefix = "cache-"
vpc_id = var.vpc_id
description = "Security group for ElastiCache"
ingress {
from_port = 6379
to_port = 6379
protocol = "tcp"
security_groups = [var.app_security_group_id]
description = "Redis from application"
}
ingress {
from_port = 11211
to_port = 11211
protocol = "tcp"
security_groups = [var.app_security_group_id]
description = "Memcached from application"
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
lifecycle {
create_before_destroy = true
}
}
Simple Redis and Memcached Cluster Definitions
For development or simple caching needs, a single-node Redis cluster works fine:
hcl
resource "aws_elasticache_cluster" "redis_dev" {
cluster_id = "myapp-cache-dev"
engine = "redis"
engine_version =
The module can create standalone ElastiCache clusters, primarily used for Memcached deployments or single-node Redis deployments.
Memcached Example with terraform-aws-modules
Terraform module which creates AWS ElastiCache resources.
hcl
module "elasticache" {
source = "terraform-aws-modules/elasticache/aws"
cluster_id = "example-memcached"
create_cluster = true
create_replication_group = false
engine = "memcached"
engine_version = "1.6.17"
node_type = "cache.t4g.small"
num_cache_nodes = 2
az_mode = "cross-az"
maintenance_window = "sun:05:00-sun:09:00"
apply_immediately = true
vpc_id = module.vpc.vpc_id
security_group_rules = {
ingress_vpc = {
description = "VPC traffic"
cidr_ipv4 = module.vpc.vpc_cidr_block
}
}
subnet_ids = module.vpc.private_subnets
create_parameter_group = true
parameter_group_family = "memcached1.6"
parameters = [
{
name = "idle_timeout"
value = 60
}
]
tags = {
Terraform = "true"
Environment = "dev"
}
}
Redis Example with terraform-aws-modules
hcl
module "elasticache" {
source = "terraform-aws-modules/elasticache/aws"
cluster_id = "example-redis"
create_cluster = true
create_replication_group = false
engine_version = "7.1"
node_type = "cache.t4g.small"
maintenance_window = "sun:05:00-sun:09:00"
apply_immediately = true
vpc_id = module.vpc.vpc_id
security_group_rules = {
ingress_vpc = {
description = "VPC traffic"
cidr_ipv4 = module.vpc.vpc_cidr_block
}
}
subnet_ids =
The document provides a comprehensive introduction to the AWS ElastiCache Terraform module, which enables infrastructure-as-code creation and management of AWS ElastiCache resources.
Secure ElastiCache for Valkey Deployments
Building secure Amazon ElastiCache for Valkey deployments with Terraform.
Amazon ElastiCache for Valkey is a fully managed caching service delivering microsecond latency that offers a serverless option to enable automatic scaling and pay-per-use pricing with setup times under five minutes, and a traditional node-based option that provides more granular control over the infrastructure. The serverless option eliminates the complexity of capacity planning and cluster management while offering a 33% lower price compared to Redis
In this post we show you how to build a secure Amazon ElastiCache for Valkey cluster using Terraform, implementing best practices and comprehensive security controls including encryption, authentication, and network isolation.
Solution overview
Amazon ElastiCache for Valkey is a fully managed caching service delivering microsecond latency that offers a serverless option to enable automatic scaling and pay-per-use pricing with setup times under five minutes, and a traditional node-based option that provides more granular control over the infrastructure. The serverless option eliminates the complexity of capacity planning and cluster management while offering a 33% lower price compared to Redis
In this post, we'll set up ElastiCache clusters with Terraform, covering both Redis (which is far more popular) and Memcached, along with production configurations for encryption, replication, and automatic failover.
Module Component Summary
| Component | Purpose | Typical Use |
|---|---|---|
| awselasticachecluster | Standalone cluster for Memcached or single-node Redis | Development, simple caching |
| awselasticachereplication_group | Primary and replica nodes for HA and read scaling | Production Redis/Valkey |
| awselasticacheglobalreplicationgroup | Multi-region replication | Cross-region active-active |
| awselasticacheparameter_group | Engine behavior customization | Tuning timeouts, maxmemory |
| awselasticachesubnet_group | VPC subnet placement | Private subnet isolation |
| awssecuritygroup | Network access control | Application to cache |
| Engine | Version Example | Node Type Example | Nodes |
|---|---|---|---|
| memcached | 1.6.17 | cache.t4g.small | 2 |
| redis | 7.1 | cache.t4g.small | 1 |
| redis | - | cache.m4.large | 6 |
Configuration Patterns
The module offers the following key capabilities:
- Item
- Item
- Item
Networking Prerequisites
ElastiCache runs in your VPC and needs a subnet group and security group.
The terraform-aws-elasticache module consists of several integrated components that work together to create and manage ElastiCache resources.
The module can create standalone ElastiCache clusters, primarily used for Memcached deployments or single-node Redis deployments.
For Redis/Valkey deployments requiring high availability or read scaling, the module creates replication groups with primary and replica nodes.
For multi-region Redis deployments, the module supports creating global replication groups.
Conclusion
Using Terraform for Amazon ElastiCache delivers repeatable provisioning of Redis, Memcached, and Valkey clusters with consistent security and networking controls. The HashiCorp example project demonstrates a concrete six node cache.m4.large deployment paired with a t2.nano SSH bastion inside the same VPC, illustrating the need for private access and an application host for testing. The terraform-aws-elasticache module abstracts the complexity of awselasticachecluster, awselasticachereplicationgroup, awselasticacheglobalreplicationgroup, awselasticacheparametergroup, awselasticachesubnet_group, and security group rules into a single reusable module interface.
Production readiness is achieved by defining subnet groups for private placement, security groups that allow Redis port 6379 and Memcached port 11211 only from application security groups, parameter groups for engine tuning such as idletimeout, and maintenance windows with applyimmediately controls. The module supports Memcached clusters with engineversion 1.6.17, nodetype cache.t4g.small, numcachenodes 2, azmode cross-az, and Redis clusters with engineversion 7.1 on cache.t4g.small with VPC-scoped ingress rules.
For Valkey workloads, Infrastructure as Code ensures encryption keys, network isolation, and authentication tokens are consistently applied across environments. Amazon ElastiCache for Valkey provides a serverless option with automatic scaling, pay-per-use pricing, sub five minute setup, and a 33% lower price compared to Redis versus traditional node-based options that offer granular infrastructure control.
Together, the HashiCorp example, the community terraform-aws-modules, and secure Valkey guidance provide a complete path from initial git clone and AWS credential export through Terraform plan and apply to hardened, scalable in-memory caching on AWS.