Ensure that your AWS ElastiCache Redis clusters are encrypted in order to meet security and compliance requirements (keep Personally Identifiable Information safe). Data encryption helps prevent unauthorized users from reading sensitive data available on your Redis clusters and their associated cache storage systems. This includes data saved to persistent media, known as data at-rest, and data that can be intercepted as it travels through the network, between clients and cache servers, known as data in-transit.
This rule can help you with the following compliance standards:
This rule can help you work with the AWS Well-Architected Framework
This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS
When working with production data it is highly recommended to implement encryption in order to protect it from unauthorized access and fulfill compliance requirements for data-at-rest and in-transit encryption within your organization. For example, a compliance requirement is to protect sensitive data that could potentially identify a specific individual such as Personally Identifiable Information (PII), usually used in Financial Services, Healthcare and Telecommunications sectors.
Note: As of December 2017, in-transit and at-rest encryption can be enabled only for AWS ElastiCache clusters with Redis engine version 3.2.6.
To determine in-transit and at-rest encryption configuration for your AWS ElastiCache Redis clusters, perform the following:
To enable in-transit and at-rest encryption for your existing AWS ElastiCache Redis clusters, you must re-create them with the necessary encryption configuration. To relaunch the required cache clusters, perform the following: