Back to Checks
aws

ElastiCache Redis cluster has automatic failover enabled

elasticache_redis_cluster_automatic_failover_enabled
Service: elasticacheSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

Amazon ElastiCache (Redis OSS) replication groups have automatic failover set to enabled, allowing a replica to be promoted when the primary becomes unavailable

Prowler logoProwlerprowler-provider-aws

Risk

Missing automatic failover reduces availability: a primary or AZ outage can stop writes and require manual recovery, prolonging downtime.

As Redis replication is asynchronous, delayed promotion increases chances of lost or stale writes, affecting data integrity and causing client timeouts.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elasticache_redis_cluster_automatic_failover_enabled

Recommendation

Enable automatic failover with Multi-AZ, keeping at least one replica per shard in a different AZ. Regularly test failover and monitor replication lag.

Architect clients for resilience with retries and backoff to tolerate brief role changes, aligning with fault tolerance and defense in depth.

Remediation

CLI

aws elasticache modify-replication-group --replication-group-id <example_resource_id> --automatic-failover-enabled --apply-immediately

Terraform

# Terraform: enable automatic failover for a Redis replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id          = "<example_resource_id>"
  replication_group_description = "<description>"
  node_type                     = "cache.t3.small"
  number_cache_clusters         = 2
  automatic_failover_enabled    = true  # Critical: turns on automatic failover so the check passes
}

NativeIaC

# CloudFormation: enable automatic failover for a Redis replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupId: <example_resource_id>
      ReplicationGroupDescription: "<description>"
      NumCacheClusters: 2
      AutomaticFailoverEnabled: true  # Critical: turns on automatic failover so the check passes
      Engine: redis

Other

1Open the AWS Console and go to ElastiCache
2Select your Redis replication group (<example_resource_id>)
3Click Modify
4Set Auto failover to Enabled
5Check Apply immediately
6Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elasticache.elasticache_client import (
    elasticache_client,
)


class elasticache_redis_cluster_automatic_failover_enabled(Check):
    def execute(self):
        findings = []
        for repl_group in elasticache_client.replication_groups.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=repl_group)
            report.status = "FAIL"
            report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have automatic failover enabled."

            if repl_group.automatic_failover == "enabled":
                report.status = "PASS"
                report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does have automatic failover enabled."

            findings.append(report)

        return findings

References