AWS ElastiCache Redis cluster with Redis AUTH feature disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_31
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	49dbb5bd-ea99-4d84-9f76-48aba9c92243

Impact

In Amazon ElastiCache, the Redis authentication command asks users to enter a password prior to being granted permission to execute Redis commands on a password-protected server. Authentication can only be enabled when you are creating clusters with the in-transit encryption option enabled. When Redis authentication is enabled, users are required to pass through an additional layer of authentication before gaining access to the server and gaining permission to perform actions. We recommend that all data stored in the ElastiCache Replication Group is securely encrypted in-transit with an authentication token.

How to Fix

[source,go]

Resources: ReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: ...

• AuthToken: 'MySecret!AuthToken$'
• TransitEncryptionEnabled: True

---