Amazon ElastiCacheAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

# Placeholders: replace the Region and the application security group with your own. This uses the default VPC; use your own private subnets in production.
REGION=ap-south-1
APP_SG=sg-0123456789abcdef0

VPC_ID=$(aws ec2 describe-vpcs --region $REGION --filters Name=is-default,Values=true --query "Vpcs[0].VpcId" --output text)
SUBNETS=$(aws ec2 describe-subnets --region $REGION --filters Name=vpc-id,Values=$VPC_ID --query "Subnets[0:3].SubnetId" --output text)

# 1. A security group for the cache. It accepts the cache port only from the application's security group.
CACHE_SG=$(aws ec2 create-security-group --region $REGION --group-name app-cache --description "Cache" --vpc-id $VPC_ID --query GroupId --output text)
aws ec2 authorize-security-group-ingress --region $REGION --group-id $CACHE_SG --protocol tcp --port 6379 --source-group $APP_SG

# 2. Users. The built-in default user is switched off, and the application user signs in with IAM and may touch only keys that start with app:
aws elasticache create-user --region $REGION --user-id no-access --user-name default --engine valkey \
  --access-string "off ~keys* -@all +get" --no-password-required
aws elasticache create-user --region $REGION --user-id app-user --user-name app-user --engine valkey \
  --access-string "on ~app:* -@all +@read +@write +@connection" --authentication-mode Type=iam
aws elasticache create-user-group --region $REGION --user-group-id app-users --engine valkey --user-ids no-access app-user

# 3. Option A, serverless: nothing to size. The limits cap the bill, and the daily snapshot is kept for a week.
aws elasticache create-serverless-cache --region $REGION --serverless-cache-name sessions --engine valkey \
  --subnet-ids $SUBNETS --security-group-ids $CACHE_SG --user-group-id app-users \
  --cache-usage-limits "DataStorage={Maximum=10,Unit=GB},ECPUPerSecond={Maximum=50000}" \
  --snapshot-retention-limit 7 --daily-snapshot-time 21:00

# 4. Option B, node-based: two shards with one replica each, spread over zones, with failover, TLS, encryption at rest and a snapshot window.
aws elasticache create-cache-subnet-group --region $REGION --cache-subnet-group-name app-cache-subnets \
  --cache-subnet-group-description "Cache subnets" --subnet-ids $SUBNETS
aws elasticache create-replication-group --region $REGION --replication-group-id orders --replication-group-description "Orders cache" \
  --engine valkey --engine-version 8.0 --cache-node-type cache.m7g.large --num-node-groups 2 --replicas-per-node-group 1 \
  --automatic-failover-enabled --multi-az-enabled --cache-subnet-group-name app-cache-subnets --security-group-ids $CACHE_SG \
  --transit-encryption-enabled --at-rest-encryption-enabled --user-group-ids app-users \
  --snapshot-retention-limit 7 --snapshot-window 21:00-22:00 --preferred-maintenance-window sun:22:30-sun:23:30 --auto-minor-version-upgrade

# 5. Is it up, and where do clients connect?
aws elasticache describe-serverless-caches --region $REGION --serverless-cache-name sessions \
  --query "ServerlessCaches[0].{status:Status,endpoint:Endpoint.Address,reader:ReaderEndpoint.Address}"
aws elasticache describe-replication-groups --region $REGION --replication-group-id orders \
  --query "ReplicationGroups[0].{status:Status,failover:AutomaticFailover,multiAz:MultiAZ,endpoint:ConfigurationEndpoint.Address}"

# 6. Take a snapshot before a risky change, then rehearse a failover of the first shard.
aws elasticache create-snapshot --region $REGION --replication-group-id orders --snapshot-name orders-before-change
aws elasticache test-failover --region $REGION --replication-group-id orders --node-group-id 0001

# 7. Evictions and memory use of the first node in the last hour. Members of a cluster-mode group are named group-shard-node.
aws cloudwatch get-metric-statistics --region $REGION --namespace AWS/ElastiCache --metric-name DatabaseMemoryUsagePercentage \
  --dimensions Name=CacheClusterId,Value=orders-0001-001 --statistics Maximum --period 300 \
  --start-time $(date -u -d '-1 hour' +%FT%TZ) --end-time $(date -u +%FT%TZ)

# 8. Add a shard when memory or CPU stays high. Clients that follow the cluster topology pick it up without a restart.
aws elasticache modify-replication-group-shard-configuration --region $REGION --replication-group-id orders --node-group-count 3 --apply-immediately

# Placeholders: pass in your own application security group. This uses the default VPC; use your own private subnets in production.
variable "region" {
  type    = string
  default = "ap-south-1"
}

variable "app_security_group_id" {
  type = string
}

provider "aws" {
  region = var.region
}

data "aws_vpc" "default" {
  default = true
}

data "aws_subnets" "default" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.default.id]
  }
}

# The cache accepts its port only from the application's security group.
resource "aws_security_group" "cache" {
  name        = "app-cache"
  description = "Cache"
  vpc_id      = data.aws_vpc.default.id

  ingress {
    from_port       = 6379
    to_port         = 6379
    protocol        = "tcp"
    security_groups = [var.app_security_group_id]
  }
}

# The built-in default user is switched off. The application user signs in with IAM and may touch only keys that start with app:
resource "aws_elasticache_user" "no_access" {
  user_id              = "no-access"
  user_name            = "default"
  engine               = "VALKEY"
  access_string        = "off ~keys* -@all +get"
  no_password_required = true
}

resource "aws_elasticache_user" "app" {
  user_id       = "app-user"
  user_name     = "app-user"
  engine        = "VALKEY"
  access_string = "on ~app:* -@all +@read +@write +@connection"

  authentication_mode {
    type = "iam"
  }
}

resource "aws_elasticache_user_group" "app" {
  user_group_id = "app-users"
  engine        = "VALKEY"
  user_ids      = [aws_elasticache_user.no_access.user_id, aws_elasticache_user.app.user_id]
}

# Option A, serverless: nothing to size. The limits cap the bill, and the daily snapshot is kept for a week.
resource "aws_elasticache_serverless_cache" "sessions" {
  name                 = "sessions"
  engine               = "valkey"
  major_engine_version = "8"
  subnet_ids           = slice(data.aws_subnets.default.ids, 0, 3)
  security_group_ids   = [aws_security_group.cache.id]
  user_group_id        = aws_elasticache_user_group.app.user_group_id

  cache_usage_limits {
    data_storage {
      maximum = 10
      unit    = "GB"
    }
    ecpu_per_second {
      maximum = 50000
    }
  }

  snapshot_retention_limit = 7
  daily_snapshot_time      = "21:00"
}

# Option B, node-based: two shards with one replica each, spread over zones, with failover, TLS and encryption at rest.
resource "aws_elasticache_subnet_group" "cache" {
  name       = "app-cache-subnets"
  subnet_ids = slice(data.aws_subnets.default.ids, 0, 3)
}

resource "aws_elasticache_replication_group" "orders" {
  replication_group_id    = "orders"
  description             = "Orders cache"
  engine                  = "valkey"
  engine_version          = "8.0"
  node_type               = "cache.m7g.large"
  num_node_groups         = 2
  replicas_per_node_group = 1

  automatic_failover_enabled = true
  multi_az_enabled           = true
  subnet_group_name          = aws_elasticache_subnet_group.cache.name
  security_group_ids         = [aws_security_group.cache.id]

  transit_encryption_enabled = true
  at_rest_encryption_enabled = true
  user_group_ids             = [aws_elasticache_user_group.app.user_group_id]

  snapshot_retention_limit   = 7
  snapshot_window            = "21:00-22:00"
  maintenance_window         = "sun:22:30-sun:23:30"
  auto_minor_version_upgrade = true
}

output "serverless_endpoint" {
  value = aws_elasticache_serverless_cache.sessions.endpoint[0].address
}

output "cluster_endpoint" {
  value = aws_elasticache_replication_group.orders.configuration_endpoint_address
}

# pip install "redis>=5" boto3
# Connects to ElastiCache with TLS and an IAM token, then shows cache-aside reads with a lock against stampedes, and a simple rate limit.
import json
import random
import time
from urllib.parse import ParseResult, urlencode, urlunparse

import botocore.session
import redis
from botocore.model import ServiceId
from botocore.signers import RequestSigner

REGION = "ap-south-1"
TTL_SECONDS = 300
MISSING = "__missing__"


class IamCredentials(redis.CredentialProvider):
    """Signs a short-lived token (15 minutes) with the caller's AWS credentials. redis-py asks for a fresh one whenever it connects."""

    def __init__(self, user, cache_name, serverless=False):
        self.user, self.cache_name, self.serverless = user, cache_name, serverless
        session = botocore.session.get_session()
        self.signer = RequestSigner(ServiceId("elasticache"), REGION, "elasticache", "v4",
                                    session.get_credentials(), session.get_component("event_emitter"))

    def get_credentials(self):
        query = {"Action": "connect", "User": self.user}
        if self.serverless:
            query["ResourceType"] = "ServerlessCache"
        url = urlunparse(ParseResult("https", self.cache_name, "/", "", urlencode(query), ""))
        signed = self.signer.generate_presigned_url({"method": "GET", "url": url, "body": {}, "headers": {}, "context": {}},
                                                    operation_name="connect", expires_in=900, region_name=REGION)
        return self.user, signed.removeprefix("https://")


def connect(host, user, cache_name, serverless=False):
    """Serverless caches and cluster-mode groups both want a cluster-aware client. Short timeouts keep a slow cache from stalling the app."""
    return redis.RedisCluster(host=host, port=6379, ssl=True, decode_responses=True, socket_timeout=0.5, socket_connect_timeout=0.5,
                              credential_provider=IamCredentials(user, cache_name, serverless))


def jittered(ttl):
    """Spreads expiry times so that a batch of keys written together does not all expire together."""
    return ttl + random.randint(0, ttl // 10)


def get_or_load(r, key, load, ttl=TTL_SECONDS):
    """Returns the cached value. On a miss one caller runs load() under a short lock, and the others wait a moment and read the result."""
    hit = r.get(key)
    if hit is not None:
        return None if hit == MISSING else json.loads(hit)

    lock = "app:lock:" + key
    if r.set(lock, "1", nx=True, ex=10):
        try:
            value = load()
            if value is None:
                r.set(key, MISSING, ex=30)  # remember "not found" briefly, so a missing row does not hit the database every time
            else:
                r.set(key, json.dumps(value), ex=jittered(ttl))
            return value
        finally:
            r.delete(lock)

    for _ in range(20):  # another caller is loading: wait up to about a second
        time.sleep(0.05)
        hit = r.get(key)
        if hit is not None:
            return None if hit == MISSING else json.loads(hit)
    return load()  # the loader was slow: go to the database directly


def save(r, key, row, write_to_database):
    """Writes the database first, then drops the cached copy, so the next read loads the new row."""
    write_to_database(row)
    r.delete(key)


def allow(r, who, limit=100, window=60):
    """Fixed-window rate limit: True while `who` has made fewer than `limit` calls in the current window."""
    key = f"app:rate:{who}:{int(time.time()) // window}"
    count = r.incr(key)
    if count == 1:
        r.expire(key, window)
    return count <= limit


if __name__ == "__main__":
    cache = connect("sessions-abc123.serverless.aps1.cache.amazonaws.com", "app-user", "sessions", serverless=True)
    product = get_or_load(cache, "app:product:42", lambda: {"id": 42, "name": "Notebook"})
    print(product, "| allowed:", allow(cache, "user-7"))

// dotnet add package AWSSDK.ElastiCache
// Audits every ElastiCache replication group and serverless cache in the Region: encryption, sign-in, failover, snapshots and usage limits.
using Amazon.ElastiCache;
using Amazon.ElastiCache.Model;

using var elasticache = new AmazonElastiCacheClient();
int problems = 0;

void Flag(string name, string message)
{
    Console.WriteLine($"{name}: {message}");
    problems++;
}

string? marker = null;
do
{
    var page = await elasticache.DescribeReplicationGroupsAsync(new DescribeReplicationGroupsRequest { Marker = marker });
    foreach (ReplicationGroup group in page.ReplicationGroups)
    {
        string name = group.ReplicationGroupId;
        if (group.TransitEncryptionEnabled != true) Flag(name, "encryption in transit is off");
        if (group.AtRestEncryptionEnabled != true) Flag(name, "encryption at rest is off");
        if (group.AuthTokenEnabled != true && (group.UserGroupIds == null || group.UserGroupIds.Count == 0))
            Flag(name, "no password, token or user group: any client in the VPC can connect");
        if (group.MemberClusters.Count > 1 && (group.MultiAZ != MultiAZStatus.Enabled || group.AutomaticFailover != AutomaticFailoverStatus.Enabled))
            Flag(name, "has replicas but Multi-AZ or automatic failover is off");
        if (group.SnapshotRetentionLimit is null or 0) Flag(name, "automatic snapshots are off");
        if (group.AutoMinorVersionUpgrade != true) Flag(name, "automatic minor version upgrades are off");
    }
    marker = page.Marker;
} while (marker != null);

string? token = null;
do
{
    var page = await elasticache.DescribeServerlessCachesAsync(new DescribeServerlessCachesRequest { NextToken = token });
    foreach (ServerlessCache cache in page.ServerlessCaches)
    {
        string name = cache.ServerlessCacheName;
        if (string.IsNullOrEmpty(cache.UserGroupId)) Flag(name, "no user group: any client in the VPC can connect");
        if (cache.SnapshotRetentionLimit is null or 0) Flag(name, "automatic snapshots are off");
        if (cache.CacheUsageLimits?.ECPUPerSecond?.Maximum is null && cache.CacheUsageLimits?.DataStorage?.Maximum is null)
            Flag(name, "no usage limits, so the bill is not capped");
    }
    token = page.NextToken;
} while (token != null);

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;