Back to Checks
aws

ElastiCache Redis cache cluster has at rest encryption enabled

elasticache_redis_cluster_rest_encryption_enabled
Service: elasticacheSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

ElastiCache for Redis replication groups are evaluated for encryption at rest of on-disk cache data and backups. The finding pinpoints groups where this protection is not enabled.

Prowler logoProwlerprowler-provider-aws

Risk

Without at-rest encryption, cache files and snapshots can be read if storage or backups are accessed via compromise or misconfiguration. Secrets, tokens, and PII may be exposed, breaking confidentiality and aiding lateral movement through offline analysis of cached data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elasticache_redis_cluster_rest_encryption_enabled

Recommendation

Enable encryption at rest on all Redis replication groups. Use customer-managed KMS keys, apply least-privilege access to keys, and audit key usage. Plan a controlled migration since at-rest encryption is enabled at creation (backup, restore, replace). Pair with in-transit encryption and authentication for defense in depth.

Remediation

Terraform

# Terraform: enable at-rest encryption for an ElastiCache Redis replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id  = "<example_resource_id>"
  description           = "Enable at-rest encryption"
  node_type             = "cache.t3.micro"
  number_cache_clusters = 1
  at_rest_encryption_enabled = true  # CRITICAL: turns on encryption at rest for the replication group
}

NativeIaC

# CloudFormation: enable at-rest encryption for an ElastiCache Redis replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupId: <example_resource_id>
      ReplicationGroupDescription: Enable at-rest encryption
      Engine: redis
      CacheNodeType: cache.t3.micro
      NumCacheClusters: 1
      AtRestEncryptionEnabled: true  # CRITICAL: turns on encryption at rest for the replication group

Other

1In the AWS Console, go to ElastiCache > Redis
2Select the non-encrypted replication group, click Actions > Backup and create a manual backup
3After the backup completes, click Backups, select it, then Restore
4In restore settings, check/enable Encryption at rest (use default KMS key) and create the new replication group
5Update your application to use the new replication group endpoint
6Verify connectivity and data, then delete the old (non-encrypted) replication group

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elasticache.elasticache_client import (
    elasticache_client,
)


class elasticache_redis_cluster_rest_encryption_enabled(Check):
    def execute(self):
        findings = []
        for repl_group in elasticache_client.replication_groups.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=repl_group)
            report.status = "FAIL"
            report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have at rest encryption enabled."
            if repl_group.encrypted:
                report.status = "PASS"
                report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} has at rest encryption enabled."

            findings.append(report)

        return findings

References