AWS ElastiCache Redis cluster with in-transit encryption disabled (Replication group) misconfigurati

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_30
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	8d5d0339-c7be-4913-a610-3c7195106f60

Impact

ElastiCache for Redis offers optional encryption in transit. In-transit encryption provides an additional layer of data protection when transferring data over standard HTTPS protocol.

In-transit encryption can only be enabled on Redis replication groups at time of their creation.

ElastiCache for Redis in-transit encryption enables the following features:

• Encrypted connections: server and client connections are Secure Socket Layer (SSL) encrypted.
• Encrypted replication: data transfer between primary replicas is encrypted.
• Server authentication.
• Client authentication.

//

How to Fix

[source,go]

Resources: ReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: ...

• TransitEncryptionEnabled: True

---