Support at-rest and in-transit encryption for aws_elasticache_cluster (Redis)

[vlamic]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

As mentioned in #4973

ElastiCache Redis version 4.0+ supports encryption at-rest and in-transit, also for non-clustered mode.

The terraform aws_elasticache_cluster currently does not support these features.

New or Affected Resource(s)

aws_elasticache_cluster

Potential Terraform Configuration

Similar to how this is implemented in aws_elasticache_replication_group:

resource "aws_elasticache_cluster" "encrypted_redis" {
    [...]
    engine_version: "4.0.10"
    at_rest_encryption_enabled: true
    transit_encryption_enabled: true
}

References

• 2090

• https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html
• https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/at-rest-encryption.html

[trampfox]

Looks like AtRestEncryptionEnabled and TransitEncryptionEnabled are still not available in the CreateCacheClusterInput struct of the aws-sdk-go (https://github.com/aws/aws-sdk-go/blob/master/service/elasticache/api.go#L8137)

[ewbankkit]

Similar:

• https://github.com/terraform-providers/terraform-provider-aws/issues/12592

[vlamic]

This is an issue for aws-sdk-go: https://github.com/aws/aws-sdk-go/issues/3257 to track.

[vlamic]

This can be solved if using aws_elasticache_replication_group of 1 instead of aws_elasticache_cluster. Closing the issue.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!