More Info:
Ensure that your AWS ElastiCache Redis clusters are encrypted in order to meet security and compliance requirements (keep Personally Identifiable Information safe). Data encryption helps prevent unauthorized users from reading sensitive data available on your Redis clusters and their associated cache storage systems. This includes data saved to persistent media, known as data at-rest, and data that can be intercepted as it travels through the network, between clients and cache servers, known as data in-transit.Risk Level
HighAddress
SecurityCompliance Standards
GDPR, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of Elasticache not being encrypted at rest and in transit in AWS, you can follow the below steps:
- Log in to your AWS console.
- Go to the Elasticache service.
- Select the cluster that you want to encrypt.
- Click on the “Modify” button.
- Scroll down to the “Advanced Redis Settings” section.
- Enable the “Encryption in transit” option.
- Select the “Require encryption” option.
- Enable the “Encryption at rest” option.
- Select the “AWS managed CMK” option.
- Click on the “Save Changes” button.
Using CLI
Using CLI
To remediate Elasticache misconfiguration for AWS using AWS CLI, you can follow the below steps:In the above command, replace In the above command, replace In the output of the above command, verify that the
- First, you need to enable encryption at rest for Elasticache using AWS CLI. You can do this by running the following command:
<CACHE_CLUSTER_ID> with the ID of the Elasticache cluster that you want to modify and <SECURITY_GROUP_IDS> with the IDs of the security groups that you want to associate with the cluster.- After enabling encryption at rest, you need to enable encryption in transit for Elasticache using AWS CLI. You can do this by running the following command:
<CACHE_CLUSTER_ID> with the ID of the Elasticache cluster that you want to modify, <CACHE_SECURITY_GROUP_NAMES> with the names of the cache security groups that you want to associate with the cluster, and <SECURITY_GROUP_IDS> with the IDs of the security groups that you want to associate with the cluster.- Finally, verify that the Elasticache cluster is encrypted at rest and in transit. You can do this by running the following command:
TransitEncryptionEnabled and AtRestEncryptionEnabled values are set to true.By following the above steps, you can remediate the Elasticache misconfiguration for AWS using AWS CLI.Using Python
Using Python
To remediate the misconfiguration in AWS Elasticache, you can use Python and follow these steps:Note: Replace
- Open the AWS Elasticache console and select the cluster that you want to remediate.
- Click on the “Security” tab and select the “Encryption in transit” option.
- Enable encryption in transit by selecting the “Enable encryption in transit” checkbox.
- Select the appropriate security group for your cluster.
- Choose the SSL/TLS certificate that you want to use for encryption in transit.
- Click on the “Save” button to save the changes.
- Next, click on the “Encryption at rest” option.
- Enable encryption at rest by selecting the “Enable encryption at rest” checkbox.
- Choose the KMS key that you want to use for encryption at rest.
- Click on the “Save” button to save the changes.
- To automate the remediation process using Python, you can use the AWS SDK for Python (Boto3).
-
Install the Boto3 library using pip:
pip install boto3 -
Create an AWS session using the
boto3.Session()method. -
Create an Elasticache client using the
session.client('elasticache')method. -
Use the
modify_cache_cluster()method of the Elasticache client to update the cluster configuration. -
Set the
TransitEncryptionEnabledparameter toTrueto enable encryption in transit. -
Set the
AtRestEncryptionEnabledparameter toTrueto enable encryption at rest. -
Set the
KmsKeyIdparameter to the ARN of the KMS key that you want to use for encryption at rest. -
Call the
modify_cache_cluster()method to apply the changes to the cluster.
my-cluster with the name of your Elasticache cluster and arn:aws:kms:us-west-2:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234 with the ARN of your KMS key.