RBAC Authentication Should Be Enabled ElastiCache Replication Groups

Using Console

To remediate the RBAC Authentication misconfiguration for AWS ElastiCache Replication Groups, you can follow these steps using the AWS Management Console:

Sign in to the AWS Management Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and sign in using your credentials.
Navigate to ElastiCache Service: From the AWS Management Console dashboard, search for “ElastiCache” in the search bar at the top and click on the “ElastiCache” service.
Select the Replication Group: In the ElastiCache dashboard, select the replication group for which you want to enable RBAC Authentication by clicking on the replication group ID.
Modify the Replication Group: In the Replication Group details page, click on the “Modify” button at the top.
Enable RBAC Authentication: Scroll down to the “Authentication and Access Control” section in the Modify Replication Group settings. Here, you will find the option to enable RBAC Authentication.
Enable RBAC Authentication: Toggle the switch to enable RBAC Authentication for the ElastiCache Replication Group.
Save Changes: Once you have enabled RBAC Authentication, scroll to the bottom of the page and click on the “Modify” button to save the changes.
Verify RBAC Authentication: After saving the changes, verify that RBAC Authentication has been successfully enabled for the ElastiCache Replication Group.

By following these steps, you can remediate the misconfiguration of not having RBAC Authentication enabled for AWS ElastiCache Replication Groups using the AWS Management Console.

Using CLI

To enable RBAC (Role-Based Access Control) authentication for ElastiCache replication groups in AWS, specifically for AWS ElastiCache, you can follow these steps using the AWS CLI:

Update the ElastiCache Replication Group: Run the following AWS CLI command to update the ElastiCache replication group with the required parameter group that enables RBAC authentication:
aws elasticache modify-replication-group \ --replication-group-id <your-replication-group-id> \ --auth-token-enabled \ --auth-token <your-auth-token>
Replace <your-replication-group-id> with the ID of your ElastiCache replication group and <your-auth-token> with the authentication token you want to use for RBAC authentication.

Apply the Parameter Group: Create a new parameter group or update an existing one that enables RBAC authentication. You can create a new parameter group using the AWS CLI with the following command:

aws elasticache create-cache-parameter-group \
--cache-parameter-group-name <your-parameter-group-name> \
--cache-parameter-group-family redis6.x \
--description "Parameter group for RBAC authentication"

Update the parameter group with the required settings for RBAC authentication:

aws elasticache modify-cache-parameter-group \
--cache-parameter-group-name <your-parameter-group-name> \
--parameter-name-values "auth-token-enabled=true"

Replace <your-parameter-group-name> with the name of your parameter group.

Apply the Parameter Group to the Replication Group: Associate the parameter group you created or updated with your ElastiCache replication group using the following command:
aws elasticache modify-replication-group \ --replication-group-id <your-replication-group-id> \ --cache-parameter-group-name <your-parameter-group-name>
Replace <your-replication-group-id> with the ID of your ElastiCache replication group and <your-parameter-group-name> with the name of the parameter group you created or updated.
Verify the Configuration: After making these changes, verify that RBAC authentication is enabled for your ElastiCache replication group by checking the replication group details in the AWS Management Console or by running the following command:
aws elasticache describe-replication-groups --replication-group-id <your-replication-group-id>
Ensure that the AuthTokenEnabled parameter is set to true in the output.

By following these steps, you can remediate the misconfiguration and enable RBAC authentication for your AWS ElastiCache replication group using the AWS CLI.

Using Python

To remediate the misconfiguration of RBAC Authentication not being enabled for ElastiCache Replication Groups in AWS, you can follow these steps using Python:

Install the AWS SDK for Python (Boto3) if you haven’t already:

pip install boto3

Use the following Python script to enable RBAC Authentication for ElastiCache Replication Groups in AWS:

import boto3

# Initialize the ElastiCache client
client = boto3.client('elasticache')

# Specify the Replication Group ID for which you want to enable RBAC Authentication
replication_group_id = 'your_replication_group_id'

# Enable RBAC Authentication for the specified Replication Group
response = client.modify_replication_group(
    ReplicationGroupId=replication_group_id,
    AuthToken='your_auth_token_here',
    AuthTokenUpdateStrategy='SET',
    AuthTokenStatus='ENABLED'
)

# Print the response
print(response)

Replace 'your_replication_group_id' with the actual Replication Group ID for which you want to enable RBAC Authentication.
Replace 'your_auth_token_here' with the desired authentication token value.
Run the Python script to enable RBAC Authentication for the specified ElastiCache Replication Group in AWS.

After following these steps, RBAC Authentication will be enabled for the specified ElastiCache Replication Group in AWS.

Using Terraform

resource "aws_elasticache_user_group" "RBAC_USER_GROUP" {
  engine        = "redis"
  user_group_id = "YOUR_USER_GROUP_ID" # replace with the desired user group ID (must be unique in the account/region)
  user_ids      = [
    "YOUR_USER_ID_1",                   # replace with existing ElastiCache user IDs
    "YOUR_USER_ID_2",
  ]
}

resource "aws_elasticache_replication_group" "THIS_REPLICATION_GROUP" {
  replication_group_id          = "YOUR_REPLICATION_GROUP_ID" # replace with the existing replication group ID
  replication_group_description = "YOUR_DESCRIPTION"
  engine                        = "redis"
  engine_version                = "6.x"                       # must be 6.0 or higher to support RBAC

  # This is the Terraform equivalent of:
  # aws elasticache modify-replication-group --user-group-ids-to-add your-user-group-id
  user_group_ids = [
    aws_elasticache_user_group.RBAC_USER_GROUP.user_group_id,
  ]

  # Optional: mirrors --apply-immediately in the CLI example.
  # Setting this to true may cause a brief service interruption.
  apply_immediately = true
}

This change does not force replacement of the replication group, but apply_immediately = true may cause a brief service interruption when Terraform applies it.Verification: terraform plan should show an in-place update to aws_elasticache_replication_group.THIS_REPLICATION_GROUP, adding the user_group_ids attribute (or changing it from empty) to include YOUR_USER_GROUP_ID.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

RBAC Authentication Should Be Enabled ElastiCache Replication Groups

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: