aws_elasticache_cluster: redis in-transit and at-rest encryption

[alex4108]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Feature Gap in aws_elasticache_cluster prevents manging in-transit and at-rest encryption.

New or Affected Resource(s)

• aws_elasticache_cluster

Potential Terraform Configuration

resource "aws_elasticache_cluster" "demo" { 
  // ...
  auth_token = "string"
  at_rest_encryption_enabled    = true
  transit_encryption_enabled    = true
  // ...
}

References

Implementation of the topic in aws_elasticache_replication_group

• Add Redis AUTH, in-transit and at-rest encryption #2090

More descriptions & discussion about the topic

• Feature request: add auth-token parameter for aws_elasticache_cluster #4105
• aws_elasticache_cluster Encryption in-transit + Encryption at-rest arguments #2823

[alex4108]

It looks like we can work around this using this example.

resource "aws_elasticache_replication_group" "this" { 
  // ...
  auth_token = "string"
  at_rest_encryption_enabled    = true
  transit_encryption_enabled    = true
  // ...
}

resource "aws_elasticache_cluster" "this" { 
    cluster_id = "foo"
    replication_group_id = aws_elasticache_replication_group.this
}

This yields us a Redis Cluster Mode Off ElastiCache cluster with the appropriate encryption parameters

[loftwah]

It looks like we can work around this using this example.

resource "aws_elasticache_replication_group" "this" { 
  // ...
  auth_token = "string"
  at_rest_encryption_enabled    = true
  transit_encryption_enabled    = true
  // ...
}

resource "aws_elasticache_cluster" "this" { 
    cluster_id = "foo"
    replication_group_id = aws_elasticache_replication_group.this
}

This yields us a Redis Cluster Mode Off ElastiCache cluster with the appropriate encryption parameters

Thank you! This helped me out and I'm surprised I had to look so deep to find it.

Edit: it turns out I don't need the aws_elasticache_cluster resource at all here.

[Mifrill]

Hey @alex4108 regarding your comment:

This yields us a Redis Cluster

Could you please confirm it works with Redis? According to documentation for transit_encryption_enabledoption. It seems like it's only works if the engine is Memcached, not Redis, or it works with any Redis and with Memcached but only with versions 1.6.12 and later?

@loftwah Could you also please check if you using Redis engine?