ElastiCache Redis cluster does not have in-transit encryption enabled

Severity: Medium
Service: ElastiCache
Check ID: ELASTICACHE_TRANSIT_NOT_ENCRYPTED

What this check finds

Without TLS, data transmitted between your application and Redis is sent in plaintext and can be intercepted on the network. In-transit encryption cannot be added to an existing cluster.

Passing looks like: ElastiCache in-transit encryption enabled.

How to fix it

Create a new ElastiCache Redis cluster with TLS enabled and update application connection strings.

AWS CLI

aws elasticache create-replication-group --transit-encryption-enabled

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

ElastiCache → Redis clusters → Create → Security → Encryption in transit → Enable.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to ElastiCache Redis cluster does not have in-transit encryption enabled
Framework	Controls
PCI-DSS v4.0.1	4.2 PAN is protected with strong cryptography during transmission over open, public networks
HIPAA Security Rule	164.312(e)(1) Implement technical security measures to guard against unauthorized access to ePHI in transit
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management
NIST SP 800-53 Rev5 (Moderate)	SC-8 Transmission Confidentiality and Integrity SC-23 Session Authenticity
NIST Cybersecurity Framework 2.0	PR.DS-02 Data-in-transit is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More ElastiCache checks

All ElastiCache checks