[Deprecations] AWS Elasticache Security Group Rules

[imays11]

Pull Request

Issue link(s):

• https://github.com/elastic/ia-trade-team/issues/616

Summary - What I changed

ElastiCache cache security groups are only used with EC2-Classic deployments. AWS officially retired EC2-Classic and no longer supports launching ElastiCache clusters in EC2-Classic networking environments.

All modern ElastiCache deployments run in a VPC and rely on standard EC2 security groups (ec2.amazonaws.com APIs) rather than CacheSecurityGroup APIs (elasticache.amazonaws.com).

Therefore, security group behavior for Elasticache is covered by this existing rule:

• https://github.com/elastic/detection-rules/blob/fe642a879a412db71492f5d776e1e3338a531266/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml

These Elasticache Security Group rules no longer match any behavior in supported AWS environments and should be deprecated. This PR:

• Marks both rules with Deprecated - title to start deprecation process
• Updates rule description to clarify that they are only relevant for historical EC2-Classic log analysis (data from 2 years ago).
• Recommends relying on the existing EC2 security group rule for network-control changes impacting ElastiCache in VPC-based deployments.

How To Test

I've tested this scenario by creating an Elasticache cluster, creating and modifying security group rules. Below is a screenshot verifying that the activity is indeed captured by the existing EC2/VPC security group rule. There were no alerts triggered for the "Elasticache Security Group" Rules because those APIs are no longer used in modern deployments.

[github-actions]

Rule: Deprecation - Guidelines

These guidelines serve as a reminder set of considerations when recommending the deprecation of a rule.

Documentation and Context

• Description of the reason for deprecation.
• Include any context or historical data supporting the deprecation decision.

Rule Metadata Checks

• deprecated = true added to the rule metadata.
• updated_date should be the date of the PR.

Testing and Validation

• A prior rule tuning occurred for the rule where Deprecated - is prepended to the rule name, and the rule has already been released.
• Rule has be moved to the _deprecated directory.
• Double check gaps potentially or inadvertently introduced.
• Provide evidence that the rule is no longer needed or has been replaced (e.g., alternative rules, updated detection methods).