ElastiCache Redis replication group has AUTH enabled

Check ID: elasticache_redis_replication_group_auth_enabled
Provider: AWS
Service: elasticache
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon ElastiCache Redis replication groups running versions prior to 6.0 are evaluated for the use of AUTH tokens. For 6.0+, the finding indicates ACL/RBAC configuration should be reviewed instead of token-based AUTH.

Risk

Without AUTH on pre-6.0 clusters, clients can run unauthenticated commands, enabling data reads/writes, key deletion, and cache poisoning. This threatens confidentiality and integrity, and can facilitate lateral movement via stolen or injected session data.

Recommendation

Apply defense in depth:

For versions < 6.0, enable AUTH with strong, rotated tokens and require in-transit encryption.
For 6.0+, prefer RBAC/ACLs with least-privilege, deny-by-default roles.
Restrict network access to trusted sources and audit access regularly.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elasticache modify-replication-group —replication-group-id <example_resource_id> —auth-token <AUTH_TOKEN> —auth-token-update-strategy SET —apply-immediately

# Terraform: enable Redis AUTH on an existing replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id       = "<example_resource_id>"
  description                = "enable-auth"
  transit_encryption_enabled = true            # CRITICAL: required to use AUTH
  auth_token                 = "<AUTH_TOKEN>" # CRITICAL: enables Redis AUTH
  auth_token_update_strategy = "SET"       # CRITICAL: adds token; enables AUTH
}

# CloudFormation: enable Redis AUTH on an existing replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupId: <example_resource_id>
      ReplicationGroupDescription: enable-auth
      TransitEncryptionEnabled: true   # CRITICAL: required to use AUTH
      AuthToken: <AUTH_TOKEN>          # CRITICAL: enables Redis AUTH
      AuthTokenUpdateStrategy: SET  # CRITICAL: adds token; enables AUTH

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elasticache_redis_replication_group_auth_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ElastiCache Redis cluster encrypts data at rest Elastic Beanstalk streams logs to CloudWatch Logs

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires