HIGH
Source
Trivy
ID
AVD-AWS-0051

Elasticache Replication Group uses unencrypted traffic.

Traffic flowing between Elasticache replication nodes should be encrypted to ensure sensitive data is kept private.

Impact

In transit data in the Replication Group could be read if intercepted

Follow the appropriate remediation steps below to resolve the issue.

Enable in transit encryption for replication group

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
---
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
  GoodExample:
    Type: 'AWS::ElastiCache::ReplicationGroup'
    Properties:
      AutomaticFailoverEnabled: true    
      CacheNodeType: cache.r3.large
      CacheSubnetGroupName: !Ref CacheSubnetGroup
      Engine: redis
      EngineVersion: '3.2'
      NumNodeGroups: '2'
      ReplicasPerNodeGroup: '3'
      Port: 6379
      PreferredMaintenanceWindow: 'sun:05:00-sun:09:00'
      ReplicationGroupDescription: A sample replication group
      SecurityGroupIds:
      - !Ref ReplicationGroupSG
      SnapshotRetentionLimit: 5
      SnapshotWindow: '10:00-12:00'   
      TransitEncryptionEnabled: true

Enable in transit encryption for replication group

1
2
3
4
5
resource "aws_elasticache_replication_group" "good_example" {
  replication_group_id = "foo"
  replication_group_description = "my foo cluster"
  transit_encryption_enabled = true
}