top of page

ElastiCache.6

ElastiCache for Redis replication groups before version 6.0 should use Redis AUTH

Severity

Cloud Platforms

Resources

Related Standards

Automated

MEDIUM

AWS

Elasticache

NIST.800-53.r5,

This control checks if ElastiCache for Redis replication groups have Redis AUTH enabled. The control fails for an ElastiCache for Redis replication group if the Redis version of its nodes is below 6.0 and AuthToken isn't in use. When you use Redis authentication tokens, or passwords, Redis requires a password before allowing clients to run commands, which improves data security. For Redis 6.0 and later versions, we recommend using Role-Based Access Control (RBAC). Since RBAC is not supported for Redis versions earlier than 6.0, this control only evaluates versions which can't use the RBAC feature.

bottom of page