AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to disabled misconfigurat

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_50
Category - Subcategory	Storage - Redundancy
Provider	AWS
Severity	LOW
Framework	Terraform
Mapped CSPM/KSPM Rule	fb8d5776-0bfa-4349-b1ec-1684f5353707

Impact

This rule identifies ElastiCache Redis clusters that have Multi-AZ Automatic Failover feature set to disabled. It is recommended to enable the Multi-AZ Automatic Failover feature for your Redis Cache cluster, which will improve primary node reachability by providing read replica in case of network connectivity loss or loss of availability in the primary's availability zone for read/write operations.

NOTE Redis cluster Multi-AZ with automatic failover does not support T1 and T2 cache node types and is only available if the cluster has at least one read replica.

How to Fix

[source,go]

resource "aws_elasticache_replication_group" "pass" { automatic_failover_enabled = true preferred_cache_cluster_azs = ["us-west-2a", "us-west-2b"] replication_group_id = "tf-rep-group-1" description = "example description" node_type = "cache.m4.large" num_cache_clusters = 2 parameter_group_name = "default.redis3.2" port = 6379 }