Back to Checks
aws

ElastiCache Redis cache cluster has automated snapshot backups enabled with retention of at least 7 days

elasticache_redis_cluster_backup_enabled
Service: elasticacheSeverity: high
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

Amazon ElastiCache Redis replication groups have automated snapshot backups enabled with a retention period of at least 7 days.

The evaluation focuses on whether backups are enabled and the configured retention meets the minimum threshold.

Prowler logoProwlerprowler-provider-aws

Risk

Absent or short-retained backups degrade availability and heighten data loss risk. Hardware failures, corruption, or accidental deletes may not be recoverable to needed points, undermining RPO/RTO, prolonging outages, and limiting forensics on cache data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elasticache_redis_cluster_backup_enabled

Recommendation

Enable automated backups and set retention to meet RPO/RTO (typically 7 days).

  • Define a consistent snapshot window
  • Test restores regularly
  • Protect backup storage with least privilege and immutability
  • Monitor backup status for failures
  • Apply defense in depth with replicas/Multi-AZ

Remediation

CLI

aws elasticache modify-replication-group --replication-group-id <REPLICATION_GROUP_ID> --snapshot-retention-limit 7 --apply-immediately

Terraform

resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id       = "<example_resource_id>"
  replication_group_description = "<example_description>"
  snapshot_retention_limit   = 7  # Critical: enable automated backups and keep them for >=7 days
}

NativeIaC

# CloudFormation: set automated snapshot retention for a Redis replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupDescription: example
      SnapshotRetentionLimit: 7  # Critical: enables automatic snapshots and retains them for >=7 days

Other

1In the AWS Console, open ElastiCache
2Go to Redis > Replication groups
3Select <example_resource_id> and click Modify
4Set Snapshot retention (days) to 7 or higher
5Check Apply immediately
6Click Modify to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS, Severity
from prowler.providers.aws.services.elasticache.elasticache_client import (
    elasticache_client,
)


class elasticache_redis_cluster_backup_enabled(Check):
    def execute(self):
        findings = []
        for repl_group in elasticache_client.replication_groups.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=repl_group)
            report.status = "FAIL"
            report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have automated snapshot backups enabled."
            if repl_group.snapshot_retention >= elasticache_client.audit_config.get(
                "minimum_snapshot_retention_period", 7
            ):
                report.status = "PASS"
                report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} has automated snapshot backups enabled with retention period {repl_group.snapshot_retention} days."
            else:
                if repl_group.snapshot_retention > 0:
                    report.status = "FAIL"
                    report.check_metadata.Severity = Severity.low
                    report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} has automated snapshot backups enabled with retention period {repl_group.snapshot_retention} days. Recommended to increase the snapshot retention period to a minimum of 7 days."

            findings.append(report)

        return findings

References