Back to Checks
aws

MemoryDB cluster has in-transit encryption enabled

memorydb_cluster_in_transit_encryption_enabled
Service: memorydbSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Other

MemoryDB clusters are evaluated for in-transit encryption (TLS) on client and inter-node traffic (TLSEnabled=true).

Prowler logoProwlerprowler-provider-aws

Risk

Without in-transit encryption, client and inter-node traffic travels in cleartext inside the VPC.

Anyone able to observe it can read cached data and the ACL credentials clients send to authenticate, or tamper with commands, enabling MITM and replication corruption. This harms confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks memorydb_cluster_in_transit_encryption_enabled

Recommendation

Create MemoryDB clusters with TLSEnabled=true. Because this flag is immutable after creation, an unencrypted cluster must be replaced: snapshot it, restore into a new TLS-enabled cluster, then cut clients over and delete the original.

Configure clients to validate the server certificate, and pair TLS with ACL users, least-privilege security groups, and private subnets for defense in depth.

Remediation

Terraform

resource "aws_memorydb_cluster" "<example_resource_name>" {
  name       = "<example_resource_name>"
  acl_name   = "<example_acl_name>"
  node_type  = "<example_node_type>"
  num_shards = 1

  tls_enabled = true  # CRITICAL: enables TLS in-transit; forces replacement if changed
}

NativeIaC

# Enable in-transit encryption for a MemoryDB cluster
Resources:
  <example_resource_name>:
    Type: AWS::MemoryDB::Cluster
    Properties:
      ClusterName: <example_resource_name>
      ACLName: <example_acl_name>
      NodeType: <example_node_type>
      NumShards: 1
      TLSEnabled: true  # CRITICAL: enables TLS in-transit; replaces the cluster if changed

Other

1In the AWS Console, go to MemoryDB > Clusters
2Select the cluster <cluster-name> and choose Actions > Take snapshot
3Once the snapshot is available, go to Snapshots, select it and choose Actions > Restore
4In the restore form, enable "Encryption in transit" and create the cluster
5Repoint clients at the new cluster endpoint using a TLS-enabled client, then delete the old cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.memorydb.memorydb_client import memorydb_client


class memorydb_cluster_in_transit_encryption_enabled(Check):
    """Verify that every MemoryDB cluster encrypts data in transit.

    A cluster PASSES when ``TLSEnabled`` is set. The flag can only be chosen at
    creation time, so a failing cluster has to be rebuilt from a snapshot.
    """

    def execute(self) -> list[Check_Report_AWS]:
        """Execute the MemoryDB in-transit encryption check.

        Returns:
            A list of reports with each cluster in-transit encryption status.
        """
        findings = []
        for cluster in memorydb_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            if cluster.tls_enabled:
                report.status = "PASS"
                report.status_extended = f"Memory DB Cluster {cluster.name} has in-transit encryption enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"Memory DB Cluster {cluster.name} does not have in-transit encryption enabled."

            findings.append(report)

        return findings

References