feat: add AWS ElastiCache support

[mrjasonroy]

Summary

Adds full support for AWS ElastiCache (Redis mode) with IAM authentication.

Changes

Core Implementation

• ElastiCache handler: New elasticache-data-cache-handler.mjs with IAM auth support
• Unified handler: Updated data-cache-handler.mjs to support CACHE_HANDLER=elasticache
• Documentation: Added ElastiCache quick start guide to README
• CI Integration: Added optional test-elasticache job to CI workflow

Authentication Support

• ✅ Password-based authentication (auth token)
• ✅ IAM authentication (AWS credentials)
• ✅ TLS/in-transit encryption support

Features

• Uses ioredis client (same as Redis handler)
• Fully compatible with existing Redis cache handler
• Comprehensive error handling and connection retry logic
• Optional testing via GitHub repository variables and secrets

Testing

ElastiCache E2E tests are optional and only run when configured:

• Tests run if ELASTICACHE_ENDPOINT variable is set
• Required CI tests (Memory, Redis, Valkey) still pass
• ElastiCache tests are skipped if not configured

Configuration Required

To test ElastiCache integration, add these to GitHub:

Repository Variables (Settings → Secrets and variables → Actions → Variables):

• ELASTICACHE_ENDPOINT - Your ElastiCache cluster endpoint
• ELASTICACHE_PORT - Port (default: 6379)
• ELASTICACHE_USE_IAM - Set to "true" for IAM auth (default: false)
• ELASTICACHE_TLS - Set to "true" for TLS (default: true)
• AWS_REGION - AWS region (e.g., us-east-1)

Repository Secrets (Settings → Secrets and variables → Actions → Secrets):

• ELASTICACHE_AUTH_TOKEN - Auth token (if using password auth)
• AWS_ACCESS_KEY_ID - AWS access key (if using IAM auth)
• AWS_SECRET_ACCESS_KEY - AWS secret key (if using IAM auth)

Usage Example

// data-cache-handler.mjs
import Redis from "ioredis";
import { createRedisDataCacheHandler } from "@mrjasonroy/cache-components-cache-handler";

const redis = new Redis({
  host: process.env.ELASTICACHE_ENDPOINT,
  port: 6379,
  tls: {}, // Enable TLS for in-transit encryption
  username: process.env.ELASTICACHE_USER,
  password: process.env.ELASTICACHE_AUTH_TOKEN,
});

export default createRedisDataCacheHandler({
  redis,
  keyPrefix: "myapp:cache:",
  tagPrefix: "myapp:tags:",
});

Test Plan

• CI tests pass (Memory, Redis, Valkey)
• ElastiCache handler compiles without errors
• Documentation updated
• ElastiCache E2E tests (requires setup of GitHub secrets)

Next Steps

Once ElastiCache credentials are configured in GitHub, the CI will automatically run E2E tests against the real ElastiCache instance to verify full functionality.

---

🤖 Generated with Claude Code

[gemini-code-assist]

Summary of Changes

Hello @mrjasonroy, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the caching capabilities by integrating AWS ElastiCache (Redis mode) as a new supported backend. It provides robust authentication mechanisms, including IAM and password-based methods, along with TLS encryption, ensuring secure and scalable caching solutions. The changes also include comprehensive documentation and optional CI tests to validate the new integration.

Highlights

• AWS ElastiCache Support: Introduced full support for AWS ElastiCache (Redis mode), including robust IAM authentication and password-based methods.
• New ElastiCache Handler: Added a dedicated 'elasticache-data-cache-handler.mjs' file to manage ElastiCache-specific configurations, authentication, and connection logic.
• Unified Cache Handling: The main 'data-cache-handler.mjs' has been updated to dynamically switch to ElastiCache based on the 'CACHE_HANDLER' environment variable, alongside existing memory and Redis options.
• Authentication and Encryption: Implemented comprehensive support for password-based authentication, IAM authentication, and TLS/in-transit encryption for secure ElastiCache connections.
• Documentation and CI Integration: Updated the 'README.md' with a quick start guide for ElastiCache and integrated optional ElastiCache E2E tests into the CI workflow.

Ignored Files

• Ignored by pattern: .github/workflows/** (1)
  • .github/workflows/ci.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request adds support for AWS ElastiCache, including a new cache handler, test integrations, and documentation. The implementation correctly uses ioredis and provides configuration options for endpoint, port, TLS, and authentication.

However, I have identified several critical issues that need to be addressed before this can be merged:

• Critical Security Vulnerability: The implementation for IAM authentication uses the AWS_SECRET_ACCESS_KEY directly as a password. This is a major security risk and not the correct way to implement IAM auth with ElastiCache. This needs to be completely reworked to use temporary auth tokens.
• Code Duplication: There is significant code duplication between the unified test handler and the new dedicated ElastiCache handler, which will make maintenance difficult.
• Misleading Documentation: The README.md is confusing regarding authentication methods and is missing key environment variables.
• Configuration Bug: The default behavior for TLS is implemented opposite to how it's documented.

I've left specific comments with suggestions on how to resolve these issues. The security vulnerability is the most pressing concern.

[gemini-code-assist]

Using AWS_SECRET_ACCESS_KEY directly as the password is a critical security vulnerability. This key is a long-lived credential and should never be transmitted as a password. The correct approach for ElastiCache IAM authentication is to generate a short-lived authentication token using the AWS SDK and use that token as the password.

Even though this is for an e2e test app, it sets a dangerous precedent and could be accidentally copied into production code. I strongly advise against merging this implementation as is.

Please refactor this to generate a proper IAM auth token. If that's out of scope, this IAM authentication feature should be removed for now to prevent shipping insecure code.

[gemini-code-assist]

Using AWS_SECRET_ACCESS_KEY directly as the password for ElastiCache IAM authentication is a critical security vulnerability. The secret access key is a long-lived credential and should never be sent over the wire as a password. The correct procedure for IAM authentication with ElastiCache for Redis involves generating a temporary authentication token.

While the code comments acknowledge this is a 'simplified approach for testing', it establishes a dangerous pattern and is functionally incorrect for real IAM auth. This should be removed or replaced with a correct implementation before merging. Using a long-lived secret key as a password, even in test code, is too risky.

[gemini-code-assist]

The documentation for ElastiCache authentication is confusing and potentially misleading. The comment on line 103 suggests the configuration is for IAM authentication, but the code uses ELASTICACHE_AUTH_TOKEN, which is for standard password/token authentication. The list of environment variables on lines 126-128 is also incomplete, omitting variables required for IAM auth like ELASTICACHE_USE_IAM and AWS credentials.

To improve clarity, please:

1. Provide separate, clear examples for password-based authentication and IAM-based authentication.
2. For IAM authentication, add a strong warning that the current implementation in the test handler is not secure for production and explain why (it uses the secret key as a password instead of a temporary token).
3. Update the list of environment variables to be comprehensive for both authentication methods.

[gemini-code-assist]

The implementation for enabling TLS seems to contradict the documented default behavior. The PR description states that TLS is enabled by default (default: true), but the code only enables it if ELASTICACHE_TLS is explicitly set to the string "true". If the environment variable is not set, TLS will be disabled.

To align with the documented behavior of defaulting to true, you could change the logic to disable it only when explicitly set to "false".

Suggested change

	tls: process.env.ELASTICACHE_TLS === "true" ? {} : undefined,
	tls: process.env.ELASTICACHE_TLS !== "false" ? {} : undefined,