Elasticache Replication Group uses unencrypted traffic.
Traffic flowing between Elasticache replication nodes should be encrypted to ensure sensitive data is kept private.
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Enable in transit encryption for replication group
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
Resources:
GoodExample:
Type: AWS::ElastiCache::ReplicationGroup
Properties:
AutomaticFailoverEnabled: true
CacheNodeType: cache.r3.large
CacheSubnetGroupName: !Ref CacheSubnetGroup
Engine: redis
EngineVersion: "3.2"
NumNodeGroups: "2"
Port: 6379
PreferredMaintenanceWindow: sun:05:00-sun:09:00
ReplicasPerNodeGroup: "3"
ReplicationGroupDescription: A sample replication group
SecurityGroupIds:
- !Ref ReplicationGroupSG
SnapshotRetentionLimit: 5
SnapshotWindow: 10:00-12:00
TransitEncryptionEnabled: true
|
Enable in transit encryption for replication group
1
2
3
4
5
|
resource "aws_elasticache_replication_group" "good_example" {
replication_group_id = "foo"
replication_group_description = "my foo cluster"
transit_encryption_enabled = true
}
|
Links