aws_elasticache_cluster: redis in-transit and at-rest encryption

[alex4108]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Feature Gap in aws_elasticache_cluster prevents manging in-transit and at-rest encryption.

New or Affected Resource(s)

• aws_elasticache_cluster

Potential Terraform Configuration

resource "aws_elasticache_cluster" "demo" { 
  // ...
  auth_token = "string"
  at_rest_encryption_enabled    = true
  transit_encryption_enabled    = true
  // ...
}

References

Implementation of the topic in aws_elasticache_replication_group

• https://github.com/hashicorp/terraform-provider-aws/pull/2090

More descriptions & discussion about the topic

• https://github.com/hashicorp/terraform-provider-aws/issues/4105
• https://github.com/hashicorp/terraform-provider-aws/issues/2823

[alex4108]

It looks like we can work around this using this example.

resource "aws_elasticache_replication_group" "this" { 
  // ...
  auth_token = "string"
  at_rest_encryption_enabled    = true
  transit_encryption_enabled    = true
  // ...
}

resource "aws_elasticache_cluster" "this" { 
    cluster_id = "foo"
    replication_group_id = aws_elasticache_replication_group.this
}

This yields us a Redis Cluster Mode Off ElastiCache cluster with the appropriate encryption parameters

[loftwah]

It looks like we can work around this using this example.

resource "aws_elasticache_replication_group" "this" { 
  // ...
  auth_token = "string"
  at_rest_encryption_enabled    = true
  transit_encryption_enabled    = true
  // ...
}

resource "aws_elasticache_cluster" "this" { 
    cluster_id = "foo"
    replication_group_id = aws_elasticache_replication_group.this
}

This yields us a Redis Cluster Mode Off ElastiCache cluster with the appropriate encryption parameters

Thank you! This helped me out and I'm surprised I had to look so deep to find it.

Edit: it turns out I don't need the aws_elasticache_cluster resource at all here.

[Mifrill]

Hey @alex4108 regarding your comment:

This yields us a Redis Cluster

Could you please confirm it works with Redis? According to documentation for transit_encryption_enabledoption. It seems like it's only works if the engine is Memcached, not Redis, or it works with any Redis and with Memcached but only with versions 1.6.12 and later?

@loftwah Could you also please check if you using Redis engine?

[mel510]

Could you please confirm it works with Redis? According to documentation for transit_encryption_enabledoption. It seems like it's only works if the engine is Memcached, not Redis, or it works with any Redis and with Memcached but only with versions 1.6.12 and later?

@loftwah Could you also please check if you using Redis engine?

Any luck with this @Mifrill? I'm running into this as well.

[loftwah]

Mine came down to me using the incorrect resource type.

[mel510]

@loftwah Ah, I see. We have to use the replication group to be able to use the encryption arguments, even if we only want a "group" of one. Thank you!

[Mifrill]

Hey, @mel510 nope. I faced it during work on enabling the Redis in-transit and at-rest encryption for a specific service. In my case, the change of this parameter has not changed anything.