AWS ElastiCache Redis cluster with encryption for data at rest disabled misconfiguration detected in

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_29
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	f22216ac-8065-43fc-81d4-18ea427af666

Impact

ElastiCache for Redis offers default encryption at rest as a service, as well as the ability to use your own symmetric customer-managed customer master keys in AWS Key Management Service (KMS).

ElastiCache for Redis at-rest encryption encrypts the following aspects:

• Disk during sync, backup and swap operations
• Backups stored in Amazon S3

How to Fix

Resource: AWS::ElastiCache::ReplicationGroup

• Arguments: AtRestEncryptionEnabled [source,go]

---

Resources: ReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: ...

• AtRestEncryptionEnabled: True

---