ElastiCache Redis cluster keeps backups for 7 days or more

Check ID: elasticache_redis_cluster_backup_enabled
Provider: AWS
Service: elasticache
Severity: HIGH
Categories: resilience
Resource type: Other

What this check verifies

Amazon ElastiCache Redis replication groups have automated snapshot backups enabled with a retention period of at least 7 days. The evaluation focuses on whether backups are enabled and the configured retention meets the minimum threshold.

Risk

Absent or short-retained backups degrade availability and heighten data loss risk. Hardware failures, corruption, or accidental deletes may not be recoverable to needed points, undermining RPO/RTO, prolonging outages, and limiting forensics on cache data.

Recommendation

Enable automated backups and set retention to meet RPO/RTO (typically 7 days).

Define a consistent snapshot window
Test restores regularly
Protect backup storage with least privilege and immutability
Monitor backup status for failures
Apply defense in depth with replicas/Multi-AZ

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elasticache modify-replication-group —replication-group-id <REPLICATION_GROUP_ID> —snapshot-retention-limit 7 —apply-immediately

resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id       = "<example_resource_id>"
  replication_group_description = "<example_description>"
  snapshot_retention_limit   = 7  # Critical: enable automated backups and keep them for >=7 days
}

# CloudFormation: set automated snapshot retention for a Redis replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupDescription: example
      SnapshotRetentionLimit: 7  # Critical: enables automatic snapshots and retains them for >=7 days

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elasticache_redis_cluster_backup_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ElastiCache Redis cluster has automatic failover enabled ElastiCache Redis cluster encrypts data in transit

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires