Back to Checks
aws

ElastiCache Redis replication group with engine version < 6.0 has Redis OSS AUTH enabled

elasticache_redis_replication_group_auth_enabled
Service: elasticacheSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon ElastiCache Redis replication groups running versions prior to 6.0 are evaluated for the use of AUTH tokens. For 6.0+, the finding indicates ACL/RBAC configuration should be reviewed instead of token-based AUTH.

Prowler logoProwlerprowler-provider-aws

Risk

Without AUTH on pre-6.0 clusters, clients can run unauthenticated commands, enabling data reads/writes, key deletion, and cache poisoning. This threatens confidentiality and integrity, and can facilitate lateral movement via stolen or injected session data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elasticache_redis_replication_group_auth_enabled

Recommendation

Apply defense in depth:

  • For versions < 6.0, enable AUTH with strong, rotated tokens and require in-transit encryption.
  • For 6.0+, prefer RBAC/ACLs with least-privilege, deny-by-default roles.
  • Restrict network access to trusted sources and audit access regularly.

Remediation

CLI

aws elasticache modify-replication-group --replication-group-id <example_resource_id> --auth-token <AUTH_TOKEN> --auth-token-update-strategy SET --apply-immediately

Terraform

# Terraform: enable Redis AUTH on an existing replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id       = "<example_resource_id>"
  description                = "enable-auth"
  transit_encryption_enabled = true            # CRITICAL: required to use AUTH
  auth_token                 = "<AUTH_TOKEN>" # CRITICAL: enables Redis AUTH
  auth_token_update_strategy = "SET"       # CRITICAL: adds token; enables AUTH
}

NativeIaC

# CloudFormation: enable Redis AUTH on an existing replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupId: <example_resource_id>
      ReplicationGroupDescription: enable-auth
      TransitEncryptionEnabled: true   # CRITICAL: required to use AUTH
      AuthToken: <AUTH_TOKEN>          # CRITICAL: enables Redis AUTH
      AuthTokenUpdateStrategy: SET  # CRITICAL: adds token; enables AUTH

Other

1In the AWS Console, go to ElastiCache > Redis replication groups
2Select the replication group <example_resource_id> and click Modify
3Under Access control, choose Redis OSS AUTH and enter <AUTH_TOKEN>
4Check Apply immediately and click Modify
5Wait for status to return to Available; AUTH is now enabled

Check Code

from packaging import version

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elasticache.elasticache_client import (
    elasticache_client,
)


class elasticache_redis_replication_group_auth_enabled(Check):
    def execute(self):
        findings = []
        for repl_group in elasticache_client.replication_groups.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=repl_group)

            if version.parse(repl_group.engine_version) < version.parse("6.0"):
                if not repl_group.auth_token_enabled:
                    report.status = "FAIL"
                    report.status_extended = f"Elasticache Redis replication group {repl_group.id}(v{repl_group.engine_version}) does not have AUTH enabled."

                else:
                    report.status = "PASS"
                    report.status_extended = f"Elasticache Redis replication group {repl_group.id}(v{repl_group.engine_version}) does have AUTH enabled."
            else:
                report.status = "MANUAL"
                report.status_extended = f"Elasticache Redis replication group {repl_group.id} has version {repl_group.engine_version} which supports Redis ACLs. Please review the ACL configuration."

            findings.append(report)

        return findings

References