Memorystore (Valkey, Redis and Memcached)AuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

• A family, not one productMemorystore for Valkey is the newest and the one most new work should use. Memorystore for Redis Cluster and Memorystore for Redis cover Redis workloads, and Memorystore for Memcached covers plain Memcached caches.
• Shards you can resize onlineA Valkey instance in cluster mode spreads keys over shards. You add or remove shards and change the replica count while the instance serves traffic, up to a few hundred nodes in total.
• Replicas and zonesEach shard can have up to five replicas, and a multi-zone setting places the nodes in different zones. With at least one replica per shard, a failed node is replaced by a replica.
• Private Service ConnectInstances are reached through private endpoints created in your network from a service connection policy. Clients in several networks can use the same instance, and nothing has a public address.
• IAM sign-in and TLSClients can sign in with a Google access token under IAM instead of a shared password, and in-transit encryption uses a certificate authority that clients must trust.
• Backups and persistenceManaged backups run on a schedule you set and are kept for up to a year. RDB snapshots and an append-only file are available for faster recovery after a restart.
• Across RegionsCross-instance replication copies an instance to a second Region for local reads and disaster recovery.
• Vector searchMemorystore for Valkey supports vector similarity search, so a cache can also hold embeddings for semantic lookups next to the application.

Memorystore for Valkey

The current managed Valkey service. An instance has shards, replicas per shard and a node type, in cluster mode or cluster-disabled mode.

Memorystore for Redis Cluster

A managed, sharded Redis service with its own API and a Private Service Connect network model.

Memorystore for Redis

The original service, with a Basic tier (one node) and a Standard tier (a primary and a replica with automatic failover), reached through private services access.

Memorystore for Memcached

A node-based Memcached service for simple, volatile caches.

Shard

A portion of the key space, with its own primary and replicas. Adding shards adds memory and write capacity.

Cluster mode

Enabled: the key space is split by hash slot and the client must understand the cluster layout. Disabled: a single shard, and any ordinary client will do.

Node type

The size of each node, from a small shared-core type to large high-memory types. Every shard uses the same type.

Service connection policy

A rule on a network and Region that lets Memorystore create private endpoints there. It must exist before you create an instance.

Private Service Connect endpoint

A private IP address in your subnet that forwards to the instance. A discovery endpoint tells clients where the shards are.

Authorization mode

Either no sign-in or IAM authentication, where the client presents a Google access token as the password for the user named default.

Zone distribution

Whether the nodes are spread over three zones or kept in one.

Eviction policy

The instance’s rule for what goes first when memory is full. It is a setting you choose, not something to leave at the default by accident.

Time to live (TTL)

The lifetime of a key, in seconds. Once it has passed the key is gone, and keys with no lifetime pile up until memory runs out.

Cache-aside

The application tries the cache first. A miss sends it to the database, and the answer goes back into the cache with an expiry. A write updates the database and clears the cached copy.

Create a private Memorystore for Valkey instance with gcloud

1. Choose the productUse Memorystore for Valkey for new work. Take Memorystore for Redis only when you must stay on a Redis version or need its simple Basic and Standard tiers, and Memcached when you want a plain volatile cache.
2. Choose cluster modeCluster mode scales across shards and needs a cluster-aware client. Cluster-disabled mode keeps one shard, works with any client and suits small caches.
3. Create the service connection policyEnable the APIs, then create a policy for the memorystore service class on your network and Region, with the subnet the endpoints should use.
4. Create the instanceSet the shard count, one or more replicas, a multi-zone layout, IAM sign-in, TLS, deletion protection, a managed backup schedule and a maintenance window.
5. Give the application an identityGrant the service account the Memorystore connect role, and add a condition if the project holds instances it shouldn’t reach.
6. Connect with a cluster-aware clientSave the certificate authority, use TLS with it, present an access token as the password and set short timeouts.
7. Add expiries and alertsGive each key an expiry. In Cloud Monitoring, alert on memory, CPU, evictions and connection counts.
8. Test the failure casesFail a node over, restart the application during it, add a shard under load, and restore a backup into a new instance.
9. Look at the cold startClear the cache in a test and watch how hard the database works. Add a lock around rebuilds if it struggles.

• Spread load over shards, and watch for one shard running hotter than the rest because of a hot key.
• Prefer compact values; compress or break up anything beyond a few kilobytes.
• Hold connections in a pool and reuse them, since a fresh TLS connection each time is slow.
• Use hash tags for keys that belong together, so transactions and multi-key commands stay on one shard.
• Let replicas serve reads that can tolerate slightly old data.
• Never run KEYS on a big instance. Use SCAN, and read the slow log when latency climbs.
• Batch with pipelining to cut round trips.
• Put clients in the same Region and, where you can, zone as the nodes.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Memorystore.

• Pick the smallest node type that holds a shard’s share of the data with headroom, and review it as traffic changes.
• Add shards only when memory or CPU need them; every shard multiplies the node cost.
• Leave replicas out of development and test, and add them where downtime would cost you.
• Check the pricing page for committed use discounts on instances that run all the time.
• Set backup retention by how far back you would really restore, because stored backups are billed.
• Shrink values with compression before buying memory.
• Avoid cross-zone and cross-Region traffic for chatty clients where the design allows.
• Try Memorystore for Valkey first for new work, rather than moving later from an older product.
• Delete forgotten instances and old backups.
• Label instances with their team and put a budget alert on Memorystore spend.

• Use IAM authentication, and grant the connect role with a condition that names the instance.
• Turn on in-transit encryption and give clients the instance’s certificate authority.
• Reach the instance only through private endpoints, and limit which networks have one.
• Bring a customer-managed encryption key if you must control the key yourself.
• Don’t cache secrets, and cache personal data only when needed, with a short lifetime.
• Turn on deletion protection and limit who can change it.
• Send audit logs to a protected bucket, and alert on changes to instances and IAM bindings.
• Restrict who can create, update, delete and back up instances with narrow IAM roles.
• Use VPC Service Controls where your organisation needs a data perimeter.
• Review Security Command Center findings for Memorystore.

Cloud Audit Logs record who changed an instance, Cloud Asset Inventory keeps each setting’s history, Security Command Center rates them, and the Compliance Reports Manager has the attestations. Google operates the hosts and the engine. The data is yours to govern: what is cached, how long it lives, who can read it, and how the application behaves with an empty cache.

• Pick node types that fit the working set, and recheck them as traffic changes.
• Drop replicas and instances in development when nobody uses them.
• High hit rates spare the database from repeated queries.
• Keep clients and nodes close, so less data travels.
• Google reports Region carbon data, so choose a lower-carbon Region when latency and data rules allow.
• Google’s carbon footprint report works by project and service, so quote no Memorystore figure.

Purchase options

What you actually pay for

• Each node for each hour for Valkey and Redis Cluster, or every gigabyte-hour for Memorystore for Redis
• Replicas, which are nodes like any other
• Backup and persistence storage
• Network traffic between zones, between Regions, or out to the internet
• Cross-instance replication in a second Region

A private Memorystore for Valkey instance: a service connection policy, then three shards with one replica each over three zones, IAM sign-in, TLS, deletion protection, a managed backup schedule and a weekly maintenance window, plus a Standard tier Memorystore for Redis instance for comparison. The CLI tab builds both and reads their status; Terraform describes the Valkey instance and its policy. The Python tab connects with an IAM token and shows a lock that only its holder can release, a duplicate-event guard and keys that share a hash tag, and the C# tab audits every instance in a project for sign-in, encryption, replicas, zones, backups and deletion protection. Replace the project, the Region and the service account with your own.

# Placeholders: replace the project, the Region and the network. The cache gets no public address; clients reach it through Private Service Connect.
PROJECT_ID=my-project
REGION=asia-south1
NETWORK=projects/$PROJECT_ID/global/networks/default
SUBNET=projects/$PROJECT_ID/regions/$REGION/subnetworks/default
APP_SA=app@$PROJECT_ID.iam.gserviceaccount.com

gcloud services enable memorystore.googleapis.com networkconnectivity.googleapis.com --project=$PROJECT_ID

# 1. Memorystore creates its private endpoints from a service connection policy, so one must exist for the network and Region first.
gcloud network-connectivity service-connection-policies create memorystore-policy --project=$PROJECT_ID --region=$REGION \
  --network=$NETWORK --service-class=gcp-memorystore --subnets=$SUBNET

# 2. Option A, Memorystore for Valkey: three shards with one replica each, spread over three zones, IAM sign-in, TLS, a daily managed backup and a weekly window.
gcloud memorystore instances create orders-cache --project=$PROJECT_ID --location=$REGION \
  --psc-auto-connections="network=$NETWORK,projectId=$PROJECT_ID" \
  --mode=cluster --shard-count=3 --replica-count=1 --node-type=highmem-medium --engine-version=VALKEY_8_0 \
  --zone-distribution-config-mode=multi-zone --authorization-mode=iam-auth --transit-encryption-mode=server-authentication \
  --deletion-protection-enabled --engine-configs=maxmemory-policy=volatile-lru \
  --automated-backup-config-mode=enabled --automated-backup-config-retention=14d --fixed-frequency-schedule-start-time-hours=21 \
  --maintenance-policy-weekly-window="day=SUNDAY,startTime={hours=22,minutes=0}"

# 3. Option B, Memorystore for Redis (Standard tier): one primary and one replica, reached over private services access, with AUTH and TLS.
gcloud redis instances create sessions --project=$PROJECT_ID --region=$REGION --tier=standard --size=5 --redis-version=redis_7_2 \
  --connect-mode=private-service-access --network=$NETWORK --enable-auth --transit-encryption-mode=server-authentication

# 4. Let the application's service account connect with IAM. The role applies to every Memorystore instance in the project unless you add a condition.
gcloud projects add-iam-policy-binding $PROJECT_ID --member="serviceAccount:$APP_SA" --role=roles/memorystore.dbConnectionUser

# 5. Is it up, and where do clients connect? Save the certificate authority that clients use to check the server.
gcloud memorystore instances describe orders-cache --project=$PROJECT_ID --location=$REGION --format="yaml(state,mode,shardCount,replicaCount,discoveryEndpoints)"
gcloud memorystore instances get-certificate-authority orders-cache --project=$PROJECT_ID --location=$REGION

# 6. Back up before a risky change. Add a shard if memory or CPU stays high for long.
gcloud memorystore instances backup orders-cache --project=$PROJECT_ID --location=$REGION --backup-id=before-change --ttl=7d
gcloud memorystore instances update orders-cache --project=$PROJECT_ID --location=$REGION --shard-count=4

# 7. A quick inventory: every instance with its size and state.
gcloud memorystore instances list --project=$PROJECT_ID --location=$REGION --format="table(name.basename(),state,mode,shardCount,replicaCount,nodeType)"

# Placeholders: replace the project and the service account. This uses the default network; use your own network in production.
variable "project_id" {
  type = string
}

variable "region" {
  type    = string
  default = "asia-south1"
}

variable "app_service_account" {
  type = string
}

provider "google" {
  project = var.project_id
  region  = var.region
}

data "google_compute_network" "default" {
  name = "default"
}

data "google_compute_subnetwork" "default" {
  name   = "default"
  region = var.region
}

# Memorystore creates its private endpoints from a service connection policy, so one must exist for the network and Region first.
resource "google_network_connectivity_service_connection_policy" "memorystore" {
  name          = "memorystore-policy"
  location      = var.region
  service_class = "gcp-memorystore"
  network       = data.google_compute_network.default.id

  psc_config {
    subnetworks = [data.google_compute_subnetwork.default.id]
  }
}

# The Valkey instance: three shards, a replica for each, nodes in three zones, IAM sign-in, TLS, a daily managed backup and a weekly maintenance window.
resource "google_memorystore_instance" "orders" {
  instance_id    = "orders-cache"
  location       = var.region
  mode           = "CLUSTER"
  shard_count    = 3
  replica_count  = 1
  node_type      = "HIGHMEM_MEDIUM"
  engine_version = "VALKEY_8_0"

  authorization_mode          = "IAM_AUTH"
  transit_encryption_mode     = "SERVER_AUTHENTICATION"
  deletion_protection_enabled = true

  engine_configs = {
    maxmemory-policy = "volatile-lru"
  }

  zone_distribution_config {
    mode = "MULTI_ZONE"
  }

  desired_auto_created_endpoints {
    network    = data.google_compute_network.default.id
    project_id = var.project_id
  }

  automated_backup_config {
    retention = "1209600s"

    fixed_frequency_schedule {
      start_time {
        hours = 21
      }
    }
  }

  maintenance_policy {
    weekly_maintenance_window {
      day = "SUNDAY"

      start_time {
        hours   = 22
        minutes = 0
        seconds = 0
        nanos   = 0
      }
    }
  }

  depends_on = [google_network_connectivity_service_connection_policy.memorystore]
}

# The application's service account may connect with IAM. The role covers every Memorystore instance in the project unless you add a condition.
resource "google_project_iam_member" "app_connect" {
  project = var.project_id
  role    = "roles/memorystore.dbConnectionUser"
  member  = "serviceAccount:${var.app_service_account}"
}

output "endpoints" {
  value = google_memorystore_instance.orders.endpoints
}

# pip install "redis>=5" google-auth requests
# Connects to Memorystore for Valkey with TLS and an IAM access token, then shows three things a cluster needs: a lock that is released safely,
# a duplicate-event guard, and keys that share a hash tag so that they can be used together in one transaction.
import contextlib
import uuid

import google.auth
import google.auth.transport.requests
import redis

CA_FILE = "memorystore-ca.pem"  # saved with: gcloud memorystore instances get-certificate-authority
RELEASE = "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end"


class IamCredentials(redis.CredentialProvider):
    """Memorystore accepts the caller's OAuth access token as the password for the user named default. Access tokens are short-lived, so the credentials object refreshes them when they run out."""

    def __init__(self):
        self.credentials, _ = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"])
        self.request = google.auth.transport.requests.Request()

    def get_credentials(self):
        if not self.credentials.valid:
            self.credentials.refresh(self.request)
        return "default", self.credentials.token


def connect(discovery_ip):
    """A cluster-mode instance needs a cluster-aware client. The discovery endpoint tells the client where every shard lives."""
    return redis.RedisCluster(host=discovery_ip, port=6379, ssl=True, ssl_ca_certs=CA_FILE, decode_responses=True,
                              credential_provider=IamCredentials(), socket_timeout=0.5, socket_connect_timeout=1.0)


class LockBusy(Exception):
    pass


@contextlib.contextmanager
def lock(r, name, ttl_ms=10000):
    """Only the holder can release it: the Lua script deletes the key only when it still holds this caller's token, so a late release cannot free someone else's lock."""
    token = uuid.uuid4().hex
    key = f"lock:{name}"
    if not r.set(key, token, nx=True, px=ttl_ms):
        raise LockBusy(name)
    try:
        yield
    finally:
        r.eval(RELEASE, 1, key, token)


def first_time(r, event_id, ttl=86400):
    """True the first time an event id is seen in the last day. Use it to drop duplicate webhooks and retried messages."""
    return bool(r.set(f"seen:{event_id}", "1", nx=True, ex=ttl))


def cart_keys(user):
    """The part in braces decides the hash slot, so both keys live on the same shard and one transaction can touch them."""
    return f"cart:{{{user}}}:items", f"cart:{{{user}}}:count"


def add_to_cart(r, user, item, qty):
    items, count = cart_keys(user)
    with r.pipeline(transaction=True) as pipe:
        pipe.hincrby(items, item, qty)
        pipe.incrby(count, qty)
        pipe.expire(items, 86400)
        pipe.expire(count, 86400)
        return pipe.execute()[:2]


if __name__ == "__main__":
    cache = connect("10.0.0.5")
    if first_time(cache, "order-1001"):
        with lock(cache, "invoice-run"):
            print(add_to_cart(cache, "user-7", "pen", 2))

// dotnet add package Google.Cloud.Memorystore.V1
// Audits every Memorystore instance in a project, in all Regions: sign-in, encryption in transit, replicas, zones, backups and deletion protection.
using Google.Cloud.Memorystore.V1;

string project = args.Length > 0 ? args[0] : Environment.GetEnvironmentVariable("GOOGLE_CLOUD_PROJECT") ?? "my-project";
MemorystoreClient client = await MemorystoreClient.CreateAsync();
int problems = 0;

void Flag(string name, string message)
{
    Console.WriteLine($"{name}: {message}");
    problems++;
}

// The location "-" means every Region.
await foreach (Instance instance in client.ListInstancesAsync($"projects/{project}/locations/-"))
{
    string name = instance.InstanceName.InstanceId;
    if (instance.AuthorizationMode == Instance.Types.AuthorizationMode.AuthDisabled)
        Flag(name, "no sign-in: any client that reaches the endpoint can connect");
    if (instance.TransitEncryptionMode != Instance.Types.TransitEncryptionMode.ServerAuthentication)
        Flag(name, "encryption in transit is off");
    if (instance.ReplicaCount == 0)
        Flag(name, "no replicas, so a node failure means downtime and lost data");
    if (instance.ZoneDistributionConfig?.Mode != ZoneDistributionConfig.Types.ZoneDistributionMode.MultiZone)
        Flag(name, "nodes are in a single zone");
    if (instance.AutomatedBackupConfig?.AutomatedBackupMode != AutomatedBackupConfig.Types.AutomatedBackupMode.Enabled
        && (instance.PersistenceConfig == null || instance.PersistenceConfig.Mode == PersistenceConfig.Types.PersistenceMode.Disabled))
        Flag(name, "no automated backups and no persistence");
    if (!instance.DeletionProtectionEnabled)
        Flag(name, "deletion protection is off");
}

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;

Videos picked for this service. Each one is labelled with its source, opens on YouTube if you prefer, and loads only when you press play.

Typical clients are Compute Engine instances, Google Kubernetes Engine pods, Cloud Run services and Cloud Run functions, with Cloud SQL or Firestore behind the cache. Metrics and alerts live in Cloud Monitoring.