Check ID: elasticache_redis_cluster_rest_encryption_enabled
Provider: AWS
Service: elasticache
Severity: MEDIUM
Categories: encryption
Resource type: Other

​
What this check verifies

ElastiCache for Redis replication groups are evaluated for encryption at rest of on-disk cache data and backups. The finding pinpoints groups where this protection is not enabled.

​
Risk

Without at-rest encryption, cache files and snapshots can be read if storage or backups are accessed via compromise or misconfiguration. Secrets, tokens, and PII may be exposed, breaking confidentiality and aiding lateral movement through offline analysis of cached data.

​
Recommendation

Enable encryption at rest on all Redis replication groups. Use customer-managed KMS keys, apply least-privilege access to keys, and audit key usage. Plan a controlled migration since at-rest encryption is enabled at creation (backup, restore, replace). Pair with in-transit encryption and authentication for defense in depth.

​
Remediation

# Terraform: enable at-rest encryption for an ElastiCache Redis replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id  = "<example_resource_id>"
  description           = "Enable at-rest encryption"
  node_type             = "cache.t3.micro"
  number_cache_clusters = 1
  at_rest_encryption_enabled = true  # CRITICAL: turns on encryption at rest for the replication group
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elasticache_redis_cluster_rest_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks