ElastiCache replication groups should be encrypted at rest

How to fix it

• Replaces the resource: Encryption at rest is set only when a group is created, so back up the group, restore into a new group with it enabled, repoint clients, then delete the old group.
• Can break clients: The new group has new endpoints for every client to repoint to, and writes made to the old group after its backup are not in the new one.

In the console

ElastiCache → Valkey caches or Redis OSS caches → the cache → Backup, then Backups → the backup → Actions → Restore → Node-based cache

Backup Name

Any name, for the manual backup the new group is restored from

Encryption at rest

Enable

Encryption key

Default key, or a Customer managed CMK

With the AWS CLI

aws elasticache create-replication-group --replication-group-id <new-replication-group-id> --replication-group-description <description> --snapshot-name <backup-name> --cache-subnet-group-name <subnet-group-name> --at-rest-encryption-enabled --region <region>

With Terraform

• Interrupts service: Applied to an existing group, Terraform destroys it before creating the encrypted one under the same ID, so the cache is down until the restore from snapshot_name completes.

resource "aws_elasticache_replication_group" "this" {
  replication_group_id       = var.replication_group_id
  description                = var.description
  node_type                  = var.node_type
  subnet_group_name          = var.subnet_group_name
  snapshot_name              = var.backup_name
  at_rest_encryption_enabled = true
}