Elasticache Automatic Failover Should Be Enabled

Using Console

To remediate the misconfiguration of Elasticache Automatic Failover not being enabled for AWS ElastiCache using the AWS Management Console, follow these step-by-step instructions:

Access AWS Management Console: Go to the AWS Management Console at https://aws.amazon.com/ and sign in to your AWS account.
Navigate to ElastiCache Dashboard: Click on the “Services” dropdown menu at the top left corner of the console and select “ElastiCache” under the “Database” section.
Select Redis Cluster: In the ElastiCache dashboard, select the Redis cluster for which you want to enable automatic failover.
Modify the Cluster: Click on the name of the Redis cluster to access its details. In the cluster details page, click on the “Modify” button at the top.
Enable Automatic Failover: Scroll down to the “Advanced Redis settings” section in the modify cluster settings page. Look for the “Automatic Failover” option and set it to “Enabled”.
Review and Apply Changes: Review the other settings to ensure they are correct. Once you have confirmed that automatic failover is enabled and other settings are as desired, click on the “Modify” button at the bottom of the page.
Monitor the Cluster: After modifying the cluster settings, monitor the cluster to ensure that the changes have been successfully applied. You can do this by checking the cluster status in the ElastiCache dashboard.

By following these steps, you have successfully enabled automatic failover for your AWS ElastiCache Redis cluster, helping to ensure high availability and reliability for your cache system.

Using CLI

To remediate the misconfiguration of Elasticache Automatic Failover not being enabled for AWS ElastiCache using AWS CLI, follow these steps:

Enable Automatic Failover for ElastiCache Cluster: Run the following AWS CLI command to modify the ElastiCache cluster to enable automatic failover:
aws elasticache modify-replication-group --replication-group-id <your-replication-group-id> --automatic-failover-enabled
Replace <your-replication-group-id> with the ID of your ElastiCache replication group.
Verify Automatic Failover Configuration: To confirm that the automatic failover has been enabled successfully, describe the ElastiCache replication group using the following command:
aws elasticache describe-replication-groups --replication-group-id <your-replication-group-id>
Ensure that the AutomaticFailover parameter is set to enabled in the output.
Monitor and Test Failover: It is recommended to monitor the ElastiCache cluster after enabling automatic failover to ensure that it functions as expected. You can simulate a failover scenario to test the automatic failover capability.

By following these steps, you can successfully remediate the misconfiguration of Elasticache Automatic Failover not being enabled for AWS ElastiCache using AWS CLI.

Using Python

To remediate the misconfiguration of Elasticache Automatic Failover not being enabled for AWS Elasticache using Python, you can follow these steps:

Install the AWS SDK for Python (Boto3) if you haven’t already. You can install it using pip:
pip install boto3
Use the following Python script to enable Automatic Failover for your Elasticache cluster:

import boto3

# Initialize the Elasticache client
elasticache_client = boto3.client('elasticache')

# Specify the cluster identifier of your Elasticache cluster
cluster_id = 'your-cluster-id'

# Enable Automatic Failover for the specified cluster
response = elasticache_client.modify_replication_group(
    ReplicationGroupId=cluster_id,
    AutomaticFailoverEnabled=True
)

print("Automatic Failover has been enabled for the Elasticache cluster.")

Replace 'your-cluster-id' with the actual identifier of your Elasticache cluster.
Run the Python script. It will enable Automatic Failover for the specified Elasticache cluster.

By following these steps and running the Python script, you can remediate the misconfiguration of Elasticache Automatic Failover not being enabled for your AWS Elasticache cluster.

Using Terraform

resource "aws_elasticache_replication_group" "REDIS_REPLICATION_GROUP" {
  replication_group_id          = "REPLACE_WITH_REPLICATION_GROUP_ID"
  engine                        = "redis"
  # Ensure at least two cache nodes so automatic failover is supported:
  # - For non-clustered: num_cache_clusters >= 2
  # - For cluster mode:  replicas_per_node_group >= 1 (automatic failover not supported for cluster mode enabled per warning)
  num_cache_clusters            = 2 # REPLACE_IF_NEEDED

  automatic_failover_enabled    = true
  apply_immediately             = true

  # ...other required arguments (e.g., node_type, parameter_group_name, subnet_group_name, etc.)...
}

This change enables automatic failover and applies it immediately, which may cause a brief service interruption while the replication group is modified; it does not force resource replacement, but may require the group to already meet prerequisites (at least two cache clusters, and not Redis cluster mode enabled).For verification, terraform plan should show an in-place update on aws_elasticache_replication_group.REDIS_REPLICATION_GROUP with automatic_failover_enabled changing from false (or null) to true (and apply_immediately to true if it was previously false/unset).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Elasticache Automatic Failover Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: