ElastiCache replication groups should be encrypted in transit

How to fix it

• Replaces the resource: Redis OSS below 7 cannot turn this on in place (Terraform replaces below 7.0.5): upgrade the engine, or restore a backup into a new group with it on, repoint clients, delete the old.
• Can break clients: Once the mode is Required, every client that does not connect with TLS is refused, so keep it at Preferred until all of them do.

In the console

ElastiCache → Valkey caches or Redis OSS caches → the cache → Actions → Modify → Security

Encryption in transit

Enable

Transit encryption mode

Preferred first; Required once every client connects with TLS

With the AWS CLI

aws elasticache modify-replication-group --replication-group-id <replication-group-id> --transit-encryption-enabled --transit-encryption-mode preferred --region <region>

With Terraform

resource "aws_elasticache_replication_group" "this" {
  replication_group_id       = var.replication_group_id
  description                = var.description
  transit_encryption_enabled = true
  transit_encryption_mode    = "preferred"
}