Elasticache Replication Group uses unencrypted traffic.
Traffic flowing between Elasticache replication nodes should be encrypted to ensure sensitive data is kept private.
Impact
In transit data in the Replication Group could be read if intercepted
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Enable in transit encryption for replication group
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
Resources:
GoodExample:
Type: 'AWS::ElastiCache::ReplicationGroup'
Properties:
AutomaticFailoverEnabled: true
CacheNodeType: cache.r3.large
CacheSubnetGroupName: !Ref CacheSubnetGroup
Engine: redis
EngineVersion: '3.2'
NumNodeGroups: '2'
ReplicasPerNodeGroup: '3'
Port: 6379
PreferredMaintenanceWindow: 'sun:05:00-sun:09:00'
ReplicationGroupDescription: A sample replication group
SecurityGroupIds:
- !Ref ReplicationGroupSG
SnapshotRetentionLimit: 5
SnapshotWindow: '10:00-12:00'
TransitEncryptionEnabled: true
|
Enable in transit encryption for replication group
1
2
3
4
5
6
|
resource "aws_elasticache_replication_group" "good_example" {
replication_group_id = "foo"
replication_group_description = "my foo cluster"
transit_encryption_enabled = true
}
|
Links