More Info:
This rule checks whether Amazon ElastiCache replication groups have RBAC (Role-Based Access Control) authentication enabled. RBAC authentication enhances security by providing fine-grained control over access to ElastiCache resources. The rule is marked as non-compliant if the Redis version is 6 or above and the ‘UserGroupIds’ parameter is missing, empty, or does not match an entry provided by the ‘allowedUserGroupIDs’ parameter.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the RBAC Authentication misconfiguration for AWS ElastiCache Replication Groups, you can follow these steps using the AWS Management Console:
- Sign in to the AWS Management Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and sign in using your credentials.
- Navigate to ElastiCache Service: From the AWS Management Console dashboard, search for “ElastiCache” in the search bar at the top and click on the “ElastiCache” service.
- Select the Replication Group: In the ElastiCache dashboard, select the replication group for which you want to enable RBAC Authentication by clicking on the replication group ID.
- Modify the Replication Group: In the Replication Group details page, click on the “Modify” button at the top.
- Enable RBAC Authentication: Scroll down to the “Authentication and Access Control” section in the Modify Replication Group settings. Here, you will find the option to enable RBAC Authentication.
- Enable RBAC Authentication: Toggle the switch to enable RBAC Authentication for the ElastiCache Replication Group.
- Save Changes: Once you have enabled RBAC Authentication, scroll to the bottom of the page and click on the “Modify” button to save the changes.
- Verify RBAC Authentication: After saving the changes, verify that RBAC Authentication has been successfully enabled for the ElastiCache Replication Group.
Using CLI
Using CLI
To enable RBAC (Role-Based Access Control) authentication for ElastiCache replication groups in AWS, specifically for AWS ElastiCache, you can follow these steps using the AWS CLI:
-
Update the ElastiCache Replication Group:
Run the following AWS CLI command to update the ElastiCache replication group with the required parameter group that enables RBAC authentication:
Replace
<your-replication-group-id>with the ID of your ElastiCache replication group and<your-auth-token>with the authentication token you want to use for RBAC authentication. -
Apply the Parameter Group:
Create a new parameter group or update an existing one that enables RBAC authentication. You can create a new parameter group using the AWS CLI with the following command:
Update the parameter group with the required settings for RBAC authentication:Replace
<your-parameter-group-name>with the name of your parameter group. -
Apply the Parameter Group to the Replication Group:
Associate the parameter group you created or updated with your ElastiCache replication group using the following command:
Replace
<your-replication-group-id>with the ID of your ElastiCache replication group and<your-parameter-group-name>with the name of the parameter group you created or updated. -
Verify the Configuration:
After making these changes, verify that RBAC authentication is enabled for your ElastiCache replication group by checking the replication group details in the AWS Management Console or by running the following command:
Ensure that the
AuthTokenEnabledparameter is set totruein the output.
Using Python
Using Python
To remediate the misconfiguration of RBAC Authentication not being enabled for ElastiCache Replication Groups in AWS, you can follow these steps using Python:
- Install the AWS SDK for Python (Boto3) if you haven’t already:
- Use the following Python script to enable RBAC Authentication for ElastiCache Replication Groups in AWS:
-
Replace
'your_replication_group_id'with the actual Replication Group ID for which you want to enable RBAC Authentication. -
Replace
'your_auth_token_here'with the desired authentication token value. - Run the Python script to enable RBAC Authentication for the specified ElastiCache Replication Group in AWS.