Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Unused ElastiCache Reserved Cache Nodes

Trend Micro Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 750 automated best practice checks.

Risk Level: High (not acceptable risk)
Rule ID: EC-009

Ensure that all your AWS ElastiCache Reserved Nodes (RN) have corresponding cache nodes running within the same account or within any AWS accounts members of an AWS Organization (if there is any). A corresponding cache node is a running ElastiCache cluster node that matches the reservation parameters such as Region and Node Type.

This rule can help you work with the AWS Well-Architected Framework.

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Sustainability
Cost
optimisation

When an Amazon ElastiCache RCN is not in use (i.e. does not have an active corresponding cache node) the investment made is not properly exploited. For example, if you reserve a cache.m3.large ElastiCache cluster node within US East (N.Virginia) region but you don't create a cache node with the same type in the same region of the same AWS account or in any other linked AWS accounts within your AWS Organization, the specified ElastiCache RCN is considered unused and your investment has a negative return.


Audit

To determine if you have any unused ElastiCache RCNs within your AWS account or your AWS Organization (if any), perform the following:

Using AWS Console

01 Login to the AWS Management Console.

02 Navigate to ElastiCache dashboard at https://console.aws.amazon.com/elasticache/.

03 In the left navigation panel, under ElastiCache Dashboard, choose Reserved Cache Nodes.

04 Choose the active ElastiCache Reserved Node that you want to examine.

05 Click Show or Hide Item Details button to expand the details panel and check the Node Type attribute value used for reservation (e.g. cache.m3.large).

06 Within the same AWS region, in the navigation panel, under ElastiCache Dashboard, click Memcached to access the clusters created with Memcached in-memory cache engine or Redis to access the clusters created with Redis engine.

07 Choose the Memcached/Redis cluster that you want to examine for corresponding nodes, then click Show or Hide Item Details button:

Show or Hide Item Details

to expand the cluster configuration details panel.

08 On the selected cache cluster details panel, verify the Node type attribute value, e.g.

Node type

09 Now repeat step no. 7 and 8 for other ElastiCache clusters provisioned in the current AWS region. If none of the verified AWS ElastiCache cache clusters have active nodes that match the reservation type (node type) parameter identified at step no. 5, the selected Reserved Cache Node (RCN) does not have a corresponding node running within the cache clusters provisioned in the current region, therefore the selected ElastiCache RCN is not utilized.

10 If you are using Consolidated Billing and the current AWS account is member of an AWS Organization, access the ElastiCache clusters configuration page on each linked account, under the same region, and repeat step no. 7 and 8 to check for any corresponding cache cluster nodes.

11 Repeat steps no. 4 - 10 for other ElastiCache RCNs available in the current region.

12 Change the AWS region from the navigation bar and repeat the entire audit process for other regions.

Using AWS CLI

01 Run describe-reserved-cache-nodes command (OSX/Linux/UNIX) using custom query filters to list the unique identifiers of all ElastiCache RCNs available in the selected AWS region:

aws elasticache describe-reserved-cache-nodes
    --region us-east-1
    --output table
    --query 'ReservedCacheNodes[*].ReservedCacheNodeId'

02 The command output should return a table with the requested RCNs identifiers (IDs):

------------------------
| ReservedCacheNodeIds |
+----------------------+
| cc-rediswebcache-001 |
| cc-rediswebcache-002 |
+----------------------+

03 Run again describe-reserved-cache-nodes command (OSX/Linux/UNIX) using the ID of RCN that you want to examine as identifier and custom query filters to expose the cache node type used by the specified ElastiCache Reserved Cache Node:

aws elasticache describe-reserved-cache-nodes
    --region us-east-1
    --reserved-cache-node-id cc-rediswebcache-001
    --query 'ReservedCacheNodes[*].CacheNodeType'

04 The command output should return the cache node type currently used:

[
    "cache.m3.large"
]

05 Now run describe-cache-clusters command (OSX/Linux/UNIX) using custom query filters to list the identifiers (ID) of all ElastiCache clusters available in the selected region:

aws elasticache describe-cache-clusters
    --region us-east-1
    --output table
    --query 'CacheClusters[*].CacheNodeId'

06 The command output should return a table with the requested cluster identifiers:

-------------------------
| DescribeCacheClusters |
+-----------------------+
| cc-rediscache         |
| cc-webcachedcluster   |
+-----------------------+

07 Run again describe-cache-clusters command (OSX/Linux/UNIX) using the identifier (name) of the cluster that you want to examine and the custom query filters to expose the cache node(s) type used by the selected Amazon ElastiCache cluster:

aws elasticache describe-cache-clusters
    --region us-east-1
    --cache-cluster-id cc-rediscache
    --query 'CacheClusters[*].CacheNodeType'

08 The command output should return the requested cluster cache node type:

[
    "cache.r3.large"
]

Now repeat step no. 7 and 8 for other ElastiCache cache clusters provisioned in the current AWS region. If none of the verified AWS ElastiCache clusters have active nodes that match the reservation node type identified at step no. 4, the selected Reserved Cache Node does not have a corresponding cache node provisioned within the current region, therefore the selected Amazon ElastiCache RCN is not being used.

09 If you have an active AWS Consolidated Billing implementation and the current AWS account is member of an AWS Organization, repeat steps no. 5 - 8 to check for the corresponding cache cluster nodes within other AWS accounts, members of your AWS Organization.

10 Repeat steps no. 1 – 9 for other ElastiCache RCNs purchased within the current region.

11 Change the AWS region by updating the --region command parameter value and perform the audit process for other regions.

Remediation / Resolution

Because AWS ElastiCache Reserved Cache Nodes are reserved for you at purchase, you cannot modify, cancel or sell these reservations and you will be billed for these resources regardless of whether you use them. To make use of your investment, you can provision and utilize a corresponding cache node for each unused RCN purchased within the current AWS account or within any other member accounts available in your AWS Organization (if you are using one). To create ElastiCache cache nodes that match the RCNs purchase criteria, perform the following:

Note: As example, this section will explain how to create a new ElastiCache Redis cache cluster within the same AWS region.

Using AWS Console

01 Login to the AWS Management Console.

02 Navigate to ElastiCache dashboard at https://console.aws.amazon.com/elasticache/.

03 In the navigation panel, under ElastiCache Dashboard, click Redis to access the clusters created with Redis in-memory cache engine then click Create to initiate the new cache cluster setup.

04 On Create your Amazon ElastiCache cluster page, perform the following actions:

  1. Chose Redis from the Cluster Engine section to select the in-memory cache engine that will run the cluster.
  2. Within Redis settings section, choose the required cache node type from the Node type dropdown list (see Audit section part I, step no. 5 to identify the right node type used for reservation). Configure the rest of the cluster parameters based on your application requirements.
  3. Click Advanced Redis settings tab to expand the cluster advanced settings panel and customize your cluster configuration as needed.
  4. Click the Create button to launch your new Amazon ElastiCache cluster. Once the cache cluster has been successfully created, its status should change from creating to available.

05 Repeat step no. 3 and 4 to provision new ElastiCache clusters with corresponding cache nodes for other Amazon ElastiCache RCNs purchased in the current AWS region/account or within any other member accounts available in your AWS Organization (if applicable).

06 Change the AWS region from the navigation bar and repeat the remediation process for other regions.

Using AWS CLI

01 Run create-cache-cluster command (OSX/Linux/UNIX) to launch a new Amazon ElastiCache cluster with corresponding cache nodes that match the existing RCN purchase criteria. The following command example creates an AWS ElastiCache Redis cache cluster with one initial cache.m3.large node, within US East (N. Virginia) AWS region:

aws elasticache create-cache-cluster
    --region us-east-1
    --cache-cluster-id rediscachecluster
    --num-cache-nodes 1
    --cache-node-type cache.m3.large
    --engine redis
    --engine-version "3.2.4"
    --security-group-ids "sg-5f9ab421"
    --port 6379

02 The command output should return the new ElastiCache cluster configuration metadata:

{
    "CacheCluster": {
        "Engine": "redis",
        "CacheParameterGroup": {
            "CacheNodeIdsToReboot": [],
            "CacheParameterGroupName": "default.redis3.2",
            "ParameterApplyStatus": "in-sync"
        },
        "CacheClusterId": "rediscachecluster",
        "NumCacheNodes": 1,
        "AutoMinorVersionUpgrade": true,
        "CacheClusterStatus": "creating",

         ...

        "CacheSubnetGroupName": "default",
        "EngineVersion": "3.2.4",
        "PendingModifiedValues": {},
        "PreferredMaintenanceWindow": "sat:04:30-sat:05:30",
        "CacheNodeType": "cache.m3.large"
    }
}

03 Repeat step no. 1 and 2 to create new ElastiCache clusters with corresponding cache nodes for other Amazon ElastiCache RCNs purchased within the current AWS region/account or within any other member accounts available in your AWS Organization (if applicable).

04 Change the AWS region by updating the --region command parameter value and perform the entire process for other regions.

References

Publication date Mar 7, 2017

Unlock the Remediation Steps


Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

Confirmity Cloud Platform

No thanks, back to article

You are auditing:

Unused ElastiCache Reserved Cache Nodes

Risk Level: High