Back to Checks
aws

ElastiCache Redis cache cluster has in-transit encryption enabled

elasticache_redis_cluster_in_transit_encryption_enabled
Service: elasticacheSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

ElastiCache for Redis replication groups have in-transit encryption (TLS) enabled for client and inter-node traffic (TransitEncryptionEnabled=true).

Prowler logoProwlerprowler-provider-aws

Risk

Absent in-transit encryption, traffic between apps and Redis or between nodes can be eavesdropped or tampered.

This exposes keys, tokens, and cached sensitive data, enables MITM and session hijacking, and can corrupt replication, harming confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elasticache_redis_cluster_in_transit_encryption_enabled

Recommendation

Enable TLS by setting TransitEncryptionEnabled=true and enforce a strict mode (require TLS 1.2+).

Ensure clients validate certificates, restrict network paths, and pair with least privilege plus Redis AUTH/RBAC for defense in depth.

Remediation

CLI

aws elasticache modify-replication-group --replication-group-id <example_resource_id> --transit-encryption-enabled --transit-encryption-mode preferred --apply-immediately

Terraform

# Enable in-transit encryption for a Redis replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id       = "<example_resource_id>"
  description                = "<example_description>"
  node_type                  = "cache.t3.micro"
  num_cache_clusters         = 1
  subnet_group_name          = "<example_resource_name>"
  transit_encryption_enabled = true  # CRITICAL: enables TLS in-transit to pass the check
}

NativeIaC

# CloudFormation: enable in-transit encryption for a Redis replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupId: "<example_resource_id>"
      ReplicationGroupDescription: "<example_description>"
      NumCacheClusters: 1
      CacheSubnetGroupName: "<example_resource_name>"
      TransitEncryptionEnabled: true  # CRITICAL: enables TLS in-transit to pass the check

Other

1In the AWS Console, go to ElastiCache > Redis OSS (or Valkey) replication groups
2Select the replication group and click Actions > Modify
3Under Security, enable Encryption in transit and set Transit encryption mode to Preferred
4Check Apply immediately and Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elasticache.elasticache_client import (
    elasticache_client,
)


class elasticache_redis_cluster_in_transit_encryption_enabled(Check):
    def execute(self):
        findings = []
        for repl_group in elasticache_client.replication_groups.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=repl_group)
            report.status = "FAIL"
            report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have in transit encryption enabled."
            if repl_group.transit_encryption:
                report.status = "PASS"
                report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} has in transit encryption enabled."

            findings.append(report)

        return findings

References