ElastiCache Redis cluster encrypts data in transit

Check ID: elasticache_redis_cluster_in_transit_encryption_enabled
Provider: AWS
Service: elasticache
Severity: MEDIUM
Categories: encryption
Resource type: Other

What this check verifies

ElastiCache for Redis replication groups have in-transit encryption (TLS) enabled for client and inter-node traffic (TransitEncryptionEnabled=true).

Risk

Absent in-transit encryption, traffic between apps and Redis or between nodes can be eavesdropped or tampered. This exposes keys, tokens, and cached sensitive data, enables MITM and session hijacking, and can corrupt replication, harming confidentiality and integrity.

Recommendation

Enable TLS by setting TransitEncryptionEnabled=true and enforce a strict mode (require TLS 1.2+). Ensure clients validate certificates, restrict network paths, and pair with least privilege plus Redis AUTH/RBAC for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elasticache modify-replication-group —replication-group-id <example_resource_id> —transit-encryption-enabled —transit-encryption-mode preferred —apply-immediately

# Enable in-transit encryption for a Redis replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id       = "<example_resource_id>"
  description                = "<example_description>"
  node_type                  = "cache.t3.micro"
  num_cache_clusters         = 1
  subnet_group_name          = "<example_resource_name>"
  transit_encryption_enabled = true  # CRITICAL: enables TLS in-transit to pass the check
}

# CloudFormation: enable in-transit encryption for a Redis replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupId: "<example_resource_id>"
      ReplicationGroupDescription: "<example_description>"
      NumCacheClusters: 1
      CacheSubnetGroupName: "<example_resource_name>"
      TransitEncryptionEnabled: true  # CRITICAL: enables TLS in-transit to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elasticache_redis_cluster_in_transit_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ElastiCache Redis cluster keeps backups for 7 days or more ElastiCache Redis replication group has Multi-AZ enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires