ElastiCache cache needs no credential to connect
- Severity
- High
- Service
- ElastiCache
- Check ID
- ELASTICACHE_NO_AUTH
What this check finds
A Redis or Valkey cache with neither an AUTH token nor an RBAC user group, or any Memcached cache, accepts every client that reaches its port. Its security groups and network are then its only defence, and anything that reaches the network — a compromised instance, task or function — can read and overwrite what it holds.
Passing looks like: ElastiCache requires a credential to connect.
How to fix it
Require a credential. Redis and Valkey: attach an RBAC user group, or set an AUTH token with in-transit encryption. Memcached has no authentication: keep it in private subnets reachable only from the security groups that need it, or move to Redis or Valkey with RBAC.
AWS CLI
aws elasticache modify-replication-group --replication-group-id RG_ID --user-group-ids-to-add USER_GROUP_ID --apply-immediately
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
ElastiCache → User group management → Create user group, then select the cache → Modify → Access control → User group access control list.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs