ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled

How to fix it

• Replaces the resource: A token needs encryption in transit, which below Redis OSS 7 cannot be turned on in place: upgrade to 6.0 or later, or restore a backup into a new group with both, repoint, delete.
• Can break clients: ROTATE still lets clients connect without the token; once all of them send it, repeat the call with SET, after which clients without it are refused.

In the console

ElastiCache → Redis OSS caches → the cache → Actions → Modify

Access control

Redis OSS AUTH default user access

Redis OSS AUTH token

A new token of 16 to 128 printable characters

Engine Version Compatibility

Or 6.0 or later instead, where role-based access control replaces AUTH

With the AWS CLI

• Interrupts service: --apply-immediately also applies any pending change to the group now, such as a node type or engine version change, which can replace nodes.

aws elasticache modify-replication-group --replication-group-id <replication-group-id> --auth-token <auth-token> --auth-token-update-strategy ROTATE --apply-immediately --region <region>

With Terraform

resource "aws_elasticache_replication_group" "this" {
  replication_group_id       = var.replication_group_id
  description                = var.description
  transit_encryption_enabled = true
  auth_token                 = var.auth_token
  auth_token_update_strategy = "ROTATE"
}