Support ElastiCache/Redis In-Transit and At-Rest Encryption

[ewbankkit]

Recently announced support for in-transit and at-rest encryption for ElastiCache for Redis clusters. Add support in Terraform.

[nathanielks]

@ewbankkit are you working on this? I'm getting started on this myself!

[nathanielks]

https://github.com/terraform-providers/terraform-provider-aws/pull/2090

[ewbankkit]

No, just added it as an issue that I'd tackle sooner or later if nobody got to it first. Thanks for tackling this.

[nathanielks]

Surely! I've been looking for something I could contribute to and this looked like a great opportunity!

[yelvert]

It looks like this is already possible by using a custom parameter group, http://docs.aws.amazon.com/AmazonElastiCache/latest/UserGuide/ParameterGroups.Redis.html.

[nathanielks]

@yelvert see https://github.com/terraform-providers/terraform-provider-aws/pull/2090 and https://github.com/terraform-providers/terraform-provider-aws/pull/2090#issuecomment-342309110. Just waiting on Review/Merge now!

[ghost]

Any news about this PR?

[guybumbling]

I am very interested in progress on this effort. Looking forward to news of it's release. Thanks for taking on this task.

[LukaszTheProgrammer]

I saw that the encryption enhancement is on master so far. Any news when it will be released ?

[nathanielks]

@LukaszTheProgrammer Looking at the Changelog history, I can see releases averaging every week to 2 weeks. It shouldn't be too much longer! It's also possible to build master locally and use it sooner if you like!

[LukaszTheProgrammer]

Thanks for the info.

[jayudhandha]

@yelvert I have checked your suggestion https://github.com/terraform-providers/terraform-provider-aws/issues/2087#issuecomment-344365352 But it looks like there is not any specific option to enable the In-Transit/At-Rest encryption in Custom Parameter group. Please guide!

[jayudhandha]

Any update on this?

[dave-receptiviti]

It would really be awesome to be able to terraform this part of the infrastructure (encryption is a prerequisite) :)

[nathanielks]

@dave-receptiviti @jayudhandha the changes were rolled out in 1.6, so it's officially supported now!

• at_rest_encryption_enabled - (Optional) Whether to enable encryption at rest.
• transit_encryption_enabled - (Optional) Whether to enable encryption in transit.
• auth_token - (Optional) The password used to access a password protected server. Can be specified only if transit_encryption_enabled = true.

https://www.terraform.io/docs/providers/aws/r/elasticache_replication_group.html

[nathanielks]

Maintainers: this issue is resolved, so it can be closed!

[jayudhandha]

@nathanielks I am using 1.2 right now. Is there any changes that i need to take care if i am upgrading to 1.6?

[nathanielks]

@jayudhandha best bet would be to consult the changelog: https://github.com/terraform-providers/terraform-provider-aws/blob/master/CHANGELOG.md

[bflad]

This was previously released in version 1.6.0 of the AWS provider and has been available in all releases since. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[jl2501]

This is not yet available for AWS ElastiCache Redis w/out Cluster Mode Enabled?

[nathanielks]

@jl2501 correct, this is only for ElastiCache Replication Groups.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!