Use the Conformity Knowledge Base AI to help improve your Cloud Posture

ElastiCache Instance Generation

Trend Micro Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 750 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: EC-001

Ensure that all the Amazon ElastiCache cache clusters provisioned in your AWS account are using the latest generation of cache node types in order to get the best performance with lower costs. If you are using cache nodes from the previous generation, Trend Micro Cloud One™ – Conformity strongly recommends that you upgrade your nodes with their latest generation equivalents.

This rule can help you work with the AWS Well-Architected Framework.

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Performance
efficiency
Cost
optimisation

Using the latest generation of Amazon ElastiCache cluster nodes instead of the previous generation nodes has tangible benefits such as better hardware performance (more computing capacity and faster CPUs, memory optimization, superior I/O, and higher network throughput), better support for the newest Redis/Memcached engine versions, and lower costs for CPU, memory, and storage.


Audit

To determine if there are any ElastiCache clusters running on cache nodes from the previous generation available in your AWS cloud account, perform the following actions:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon ElastiCache console at https://console.aws.amazon.com/elasticache/.

03 In the main navigation panel, under Resources, choose Redis clusters to access the cache clusters created with the Redis cache engine or Memcached clusters to access the clusters created with the Memcached in-memory cache engine.

04 Click on the name (link) of the Redis/Memcached cache cluster that you want to examine.

05 In the Cluster details section check the Node type attribute value to determine if the cache cluster is using a node type from a previous generation. If the node type used for the selected Amazon ElastiCache cache cluster is from the previous generation, the node type should be listed on this page under Previous generation.

06 Repeat steps no. 4 and 5 for each Amazon ElastiCache cluster available within the current AWS region.

07 Change the AWS cloud region from the navigation bar and repeat the Audit process for other regions.

Using AWS CLI

01 Run describe-cache-clusters command (OSX/Linux/UNIX) to list the name of each Amazon ElastiCache cluster available in the selected AWS cloud region:

aws elasticache describe-cache-clusters
  --region us-east-1
  --output table
  --query 'CacheClusters[*].CacheClusterId'

02 The command output should return a table with the requested cluster names:

-------------------------------------
|       DescribeCacheClusters       |
+-----------------------------------+
|  cc-production-memcache-cluster   |
|  cc-production-cache-cluster-001  |
|  cc-production-cache-cluster-002  |
+-----------------------------------+

03 Run describe-cache-clusters command (OSX/Linux/UNIX) using the name of the Amazon ElastiCache cluster that you want to examine as the identifier parameter and custom query filters to describe the type of the node configured for the selected cache cluster:

aws elasticache describe-cache-clusters
  --region us-east-1
  --cache-cluster-id cc-production-memcache-cluster
  --query 'CacheClusters[*].CacheNodeType'

04 The command output should return the requested cluster node information:

[
	"cache.r3.large"
]

If the node type used for the selected Amazon ElastiCache cache cluster, returned by the describe-cache-clusters command output, is from the previous generation, the node type should be listed on this page.

05 Repeat steps no. 3 and 4 for each ElastiCache cluster available in the selected AWS region.

06 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the Audit process for other AWS regions.

Remediation / Resolution

To upgrade your previous generation Amazon ElastiCache cluster nodes to their latest generation equivalents, perform the following actions:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon ElastiCache console at https://console.aws.amazon.com/elasticache/.

03 In the main navigation panel, under Resources, choose Redis clusters to access the cache clusters created with the Redis cache engine or Memcached clusters to access the clusters created with the Memcached**in-memory cache engine.

04 Select the Redis/Memcached cache cluster that you want to reconfigure, choose Actions, and select Modify.

05 In the Cluster settings section, choose the node type that meets your processing power and memory requirements and select the latest generation node type, equivalent to the previous generation type, from the Node type dropdown list. See the AWS documentation available here to make sure that you choose the right type for your Amazon ElastiCache cluster nodes.

06 Choose Preview changes and select Yes under Apply immediately if you want to apply the changes immediately. If Yes is not selected, the changes will be processed during the next maintenance window. Choose Modify to apply the configuration changes.

07 Repeat steps no. 4 – 6 for each ElastiCache cache cluster that you want to reconfigure, available within the current AWS region.

08 Change the AWS cloud region from the navigation bar and repeat the Remediation process for other regions.

Using AWS CLI

01 Based on the cache engine type used by your Amazon ElastiCache cluster, perform one of the following sets of commands:

  1. For Redis cache clusters:
    • Run modify-replication-group command (OSX/Linux/UNIX) to resize the cache nodes for the selected Redis cache cluster in order to upgrade the nodes to the latest generation type, equivalent to the previous generation type. See the AWS documentation available here to make sure that you choose the right type for your Amazon ElastiCache cluster nodes. The following command request example makes use of --apply-immediately parameter to apply the configuration changes asynchronously and as soon as possible. Any changes available in the pending modifications queue are also applied with this request. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for your ElastiCache application. If the --apply-immediately parameter is not specified, the configuration change will be processed during the next maintenance window. The following command request example upgrades the node type from "cache.r3.large" (previous generation) to "cache.r5.large" (current generation):
      aws elasticache modify-replication-group
        --region us-east-1
        --replication-group-id cc-production-cache-cluster
        --cache-node-type cache.r5.large
        --apply-immediately
      
    • The command output should return the information available for the reconfigured cache cluster:
      {
      	"ReplicationGroup": {
      		"ReplicationGroupId": "cc-production-cache-cluster",
      		"Description": " ",
      		"GlobalReplicationGroupInfo": {},
      		"Status": "available",
      		"PendingModifiedValues": {},
      		"MemberClusters": [
      			"cc-production-cache-cluster-001",
      			"cc-production-cache-cluster-002"
      		],
      
      		...
      
      
      		"AutomaticFailover": "disabled",
      		"MultiAZ": "disabled",
      		"SnapshotWindow": "05:30-06:30",
      		"CacheNodeType": "cache.r5.large",
      		"TransitEncryptionEnabled": false,
      		"AtRestEncryptionEnabled": false,
      		"LogDeliveryConfigurations": [],
      		"ReplicationGroupCreateTime": "2022-10-19T12:01:49.496000+00:00",
      		"DataTiering": "disabled"
      	}
      }
      
  2. For Memcached cache clusters:
    • Run modify-cache-cluster command (OSX/Linux/UNIX) to resize the cache nodes for the selected Memcached cache cluster in order to upgrade the nodes to the latest generation type. See the AWS documentation available here to ensure that you choose the right type for your Amazon ElastiCache cluster nodes. The following command request example makes use of --apply-immediately parameter to apply the configuration changes asynchronously and as soon as possible. Any changes available in the pending modifications queue are also applied with this request. If any of the pending modifications require downtime, choosing this option can cause unexpected downtime for your ElastiCache application. If the --apply-immediately parameter**is not specified, the configuration change will be processed during the next maintenance window. The following command request example upgrades the node type from "cache.r3.large" (previous generation) to "cache.r5.large" (current generation):
      aws elasticache modify-cache-cluster
        --region us-east-1
        --cache-cluster-id cc-production-memcache-cluster
        --cache-node-type cache.r5.large
        --apply-immediately
      
    • The command output should return the information available for the reconfigured cache cluster:
      {
      	"CacheCluster": {
      		"Engine": "memcached",
      		"CacheParameterGroup": {
      			"CacheParameterGroupName": "default.memcached1.6",
      			"ParameterApplyStatus": "in-sync"
      		},
      		"CacheClusterId": "cc-production-memcache-cluster",
      		"PreferredAvailabilityZone": "us-east-1a",
      		"ConfigurationEndpoint": {
      			"Port": 11211,
      			"Address": "cc-production-memcache-cluster.abc.cache.amazonaws.com"
      		},
      
      		...
      
      
      		"CacheClusterStatus": "modifying",
      		"NumCacheNodes": 2,
      		"TransitEncryptionEnabled": false,
      		"CacheSubnetGroupName": "default",
      		"EngineVersion": "1.6.6",
      		"PendingModifiedValues": {
      			"EngineVersion": "1.6.6"
      		},
      		"PreferredMaintenanceWindow": "sun:07:00-sun:08:00",
      		"CacheNodeType": "cache.r5.large"
      	}
      }
      

02 Repeat step no. 1 for each ElastiCache cache cluster that you want to reconfigure, available in the selected AWS region.

03 Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.

References

Publication date Oct 19, 2016

Unlock the Remediation Steps


Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

Confirmity Cloud Platform

No thanks, back to article

You are auditing:

ElastiCache Instance Generation

Risk Level: Medium