Terraform ElastiCache Infrastructure Patterns for Redis, Memcached, and Valkey

Amazon ElastiCache is a web service that allows for deploying, operating, and scaling an in-memory data store or cache and is often used to improve application performance by reading from a fast in-memory data store instead of a slower disk-based database. Currently, Elasticache supports two different engines:

Redis
Memcached

Terraform provides infrastructure as code for provisioning and managing these resources at scale. The following patterns cover standalone clusters, replication groups, global replication, serverless options, and secure network isolation using the community module and example projects.

Introduction to ElastiCache Terraform Patterns

ElastiCache runs inside your VPC and requires a subnet group and security group for network isolation. A common reference architecture creates six ElastiCache nodes of type cache.m4.large alongside a single SSH host of type t2.nano. The SSH host is placed in the same VPC because the cluster is not accessible from the public internet. The host fulfills the role of an application server for testing the cluster.

The workflow begins by cloning an example project:

$ git clone https://github.com/hashicorp/terraform-elasticache-example.git $ cd terraform-elasticache-example

Before running terraform plan and terraform apply, set environment variables with AWS account details:

export AWS_ACCESS_KEY_ID=[AWS ACCESS KEY ID] export AWS_SECRET_ACCESS_KEY=[AWS SECRET ACCESS KEY] export AWS_REGION=[AWS REGION, e.g

The example demonstrates a basic ElastiCache deployment for validation and learning.

Module Overview and Deployment Types

The terraform-aws-elasticache module enables infrastructure-as-code creation and management of AWS ElastiCache resources. The module supports multiple deployment types including Memcached clusters, Redis/Valkey clusters, replication groups, and serverless cache deployments.

The module is designed to simplify the provisioning and management of AWS ElastiCache resources through Terraform. It provides a consistent interface for creating various ElastiCache deployment types while handling the underlying complexity of resource configurations, security settings, parameter groups, and networking requirements.

Key components provided by the module include:

awselasticachecluster for standalone ElastiCache clusters, primarily used for Memcached deployments or single-node Redis deployments
awselasticachereplication_group for Redis/Valkey deployments requiring high availability or read scaling, with primary and replica nodes
awselasticacheglobalreplicationgroup for multi-region Redis deployments
awselasticacheparameter_group to customize engine behavior through configurable parameters
awselasticachesubnet_group to specify VPC subnets where ElastiCache nodes are deployed
awssecuritygroup, awsvpcsecuritygroupingressrule, awsvpcsecuritygroupegressrule to manage network access to ElastiCache resources

The module can create standalone ElastiCache clusters, replication groups with primary and replica nodes, and global replication groups.

Networking Prerequisites and Security Groups

ElastiCache runs in your VPC and needs a subnet group and security group.

A subnet group definition:

resource "aws_elasticache_subnet_group" "main" { name = "cache-subnet-group" subnet_ids = var.private_subnet_ids tags = { ManagedBy = "terraform" } }

A security group for ElastiCache with application-only ingress:

resource "aws_security_group" "cache" { name_prefix = "cache-" vpc_id = var.vpc_id description = "Security group for ElastiCache" ingress { from_port = 6379 to_port = 6379 protocol = "tcp" security_groups = [var.app_security_group_id] description = "Redis from application" } ingress { from_port = 11211 to_port = 11211 protocol = "tcp" security_groups = [var.app_security_group_id] description = "Memcached from application" } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } lifecycle { create_before_destroy = true } }

Infrastructure as Code provides a systematic approach to managing deployments, enabling version control, peer reviews, and automated deployments. For ElastiCache for Valkey, IaC ensures critical security configurations like encryption keys, network isolation, and authentication tokens are consistently applied across development, staging, and production environments.

Simple Redis Cluster Example

For development or simple caching needs, a single-node Redis cluster works fine:

resource "aws_elasticache_cluster" "redis_dev" { cluster_id = "myapp-cache-dev" engine = "redis" engine_version =

The module also supports a more complete single-node declaration via the community module:

module "elasticache" { source = "terraform-aws-modules/elasticache/aws" cluster_id = "example-redis" create_cluster = true create_replication_group = false engine_version = "7.1" node_type = "cache.t4g.small" maintenance_window = "sun:05:00-sun:09:00" apply_immediately = true vpc_id = module.vpc.vpc_id security_group_rules = { ingress_vpc = { description = "VPC traffic" cidr_ipv4 = module.vpc.vpc_cidr_block } } subnet_ids =

Memcached Cluster Configuration

Memcached clusters are commonly deployed with cross-AZ distribution and custom parameter groups.

Example configuration:

module "elasticache" { source = "terraform-aws-modules/elasticache/aws" cluster_id = "example-memcached" create_cluster = true create_replication_group = false engine = "memcached" engine_version = "1.6.17" node_type = "cache.t4g.small" num_cache_nodes = 2 az_mode = "cross-az" maintenance_window = "sun:05:00-sun:09:00" apply_immediately = true vpc_id = module.vpc.vpc_id security_group_rules = { ingress_vpc = { description = "VPC traffic" cidr_ipv4 = module.vpc.vpc_cidr_block } } subnet_ids = module.vpc.private_subnets create_parameter_group = true parameter_group_family = "memcached1.6" parameters = [ { name = "idle_timeout" value = 60 } ] tags = { Terraform = "true" Environment = "dev" } }

The parameter group family memcached1.6 is used with a parameter idle_timeout set to 60.

Replication Groups and High Availability

For Redis/Valkey deployments requiring high availability or read scaling, the module creates replication groups with primary and replica nodes.

A primary global replication group example:

module "elasticache_primary" { source = "terraform-aws-modules/elasticache/aws" replication_group_id = "example-redis-global-replication-group" create_primary_global_replication_group = true engine_version = "7.1" node_type = "cache.r7g.large" vpc_id = module.vpc.vpc_id security_group_rules = { ingress_vpc = { description = "VPC traffic" cidr_ipv4 = module.vpc.vpc_cidr_block } } subnet_ids = module.vpc.private_subnets create_parameter_group = true parameter_group_family = "redis7" tags = { Terraform = "true" Environment = "dev" } }

A secondary region module references the primary global replication group:

module "elasticache_secondary" { source = "terraform-aws-modules/elasticache/aws" providers = { aws = aws.other_region } replication_group_id = "example-redis-global-replication-group" global_replication_group_id = module.elasticache_primary.global_replication_group_id vpc_id = module.vpc.vpc_id security_group_rules = { ingress_vpc = { description = "VPC traffic" cidr_ipv4 = module.vpc.vpc_cidr_block } } subnet_ids = module.vpc.private_subnets tags = { Terraform = "true" Environment = "dev" } }

Secure Amazon ElastiCache for Valkey Deployments

Building secure Amazon ElastiCache for Valkey deployments with Terraform implements best practices and comprehensive security controls including encryption, authentication, and network isolation.

Amazon ElastiCache for Valkey is a fully managed caching service delivering microsecond latency that offers a serverless option to enable automatic scaling and pay-per-use pricing with setup times under five minutes, and a traditional node-based option that provides more granular control over the infrastructure. The serverless option eliminates the complexity of capacity planning and cluster management while offering a 33% lower price compared to Redis.

The post shows how to build a secure Amazon ElastiCache for Valkey cluster using Terraform, implementing best practices and comprehensive security controls.

Parameter Groups and Engine Tuning

Parameter groups allow customization of engine behavior.

Example Memcached parameter:

name = "idle_timeout"
value = 60

Example Redis parameter:

name = "latency-tracking"
value = "yes"

Tags commonly applied:

Terraform = "true"
Environment = "dev"

Common Resource Specifications

The following table summarizes representative configurations found in reference examples.

Resource Type	Engine	Engine Version	Node Type	Nodes	AZ Mode
Example Memcached	memcached	1.6.17	cache.t4g.small	2	cross-az
Example Redis	redis	7.1	cache.t4g.small	1
Global Primary	redis	7.1	cache.r7g.large
Reference Cluster	redis		cache.m4.large	6
SSH Host			t2.nano	1

Networking ports used:

Engine	Port	Description
Redis	6379	Redis from application
Memcached	11211	Memcached from application

Maintenance window examples:

sun:05:00-sun:09:00

Module flags:

create_cluster = true
createreplicationgroup = false
apply_immediately = true

Production Considerations

Amazon ElastiCache gives you managed Redis or Memcached clusters, handling the infrastructure, patching, and failover so you can focus on your application.

In production configurations, encryption, replication, and automatic failover are combined with the network controls described above. The subnet group references private subnets. Security group rules restrict ingress to the application security group for ports 6379 and 11211. Egress is open to 0.0.0.0/0.

The module supports serverless cache deployments and traditional node-based options. Serverless provides automatic scaling and pay-per-use pricing with setup times under five minutes. Traditional node-based provides granular control over instance type and count.

Conclusion

Terraform ElastiCache patterns span from simple single-node Redis clusters for development to multi-region global replication groups for production Valkey workloads. The community terraform-aws-elasticache module consolidates awselasticachecluster, awselasticachereplicationgroup, awselasticacheglobalreplicationgroup, awselasticacheparametergroup, awselasticachesubnet_group, and security group resources into a single reusable interface.

Network isolation is achieved through VPC-specific subnet groups and security groups that only allow traffic from the application security group on ports 6379 and 11211. Parameter groups enable fine-tuning such as idletimeout for Memcached 1.6 and latency-tracking for Redis 7.1. Maintenance windows like sun:05:00-sun:09:00 with applyimmediately true allow controlled updates.

Secure Valkey deployments benefit from IaC enforcement of encryption keys, network isolation, and authentication tokens across environments. Serverless Valkey offers automatic scaling and a 33% lower price compared to Redis with sub-five minute setup, while node-based options like cache.m4.large, cache.t4g.small, and cache.r7g.large provide explicit capacity control. The reference example of 6x cache.m4.large nodes with a t2.nano SSH host in the same private VPC remains a practical pattern for testing clusters that are not publicly accessible.