ElastiCache Redis cluster does not have at-rest encryption enabled

Severity: High
Service: ElastiCache
Check ID: ELASTICACHE_NOT_ENCRYPTED

What this check finds

Without at-rest encryption, data stored in Redis (cache contents, snapshots, backups) is unprotected on disk. Encryption at rest is required for HIPAA and PCI-DSS workloads and cannot be enabled on an existing cluster.

Passing looks like: ElastiCache encrypted at rest.

How to fix it

Create a new ElastiCache Redis cluster with at-rest encryption enabled and migrate data.

AWS CLI

aws elasticache create-replication-group --at-rest-encryption-enabled

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

ElastiCache → Redis clusters → Create → Security → Encryption at rest → Enable.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to ElastiCache Redis cluster does not have at-rest encryption enabled
Framework	Controls
PCI-DSS v4.0.1	3.5 Primary account number (PAN) is secured wherever it is stored
HIPAA Security Rule	164.312(a)(2)(iv) Encryption and Decryption of ePHI at Rest
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management C1.1 Encryption of Confidential Data
NIST SP 800-53 Rev5 (Moderate)	SC-13 Cryptographic Protection SC-28 Protection of Information at Rest
NIST Cybersecurity Framework 2.0	PR.DS-01 Data-at-rest is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More ElastiCache checks

All ElastiCache checks