ElastiCache for Redis replication groups should be encrypted with CMK¶

Ensure ElastiCache for Redis replication group are encrypted using CMK. The rule is non-compliant if the ElastiCache for Redis replication group is not encrypted using CMK.

How to fix¶

Attribute kms_key_id of aws_elasticache_replication_group must be non-empty.

Implementation options¶

Choose the option that matches how you manage Terraform. All options satisfy this control.

Option 1: Open source module (`terraform-aws-modules`)¶

If you use terraform-aws-modules/elasticache/aws, configure the required module inputs to satisfy this control. You can later migrate to the compliance.tf module with minimal changes because it is compatible by design.

module "elasticache" {
  source  = "terraform-aws-modules/elasticache/aws"
  version = ">=1.0.0,<2.0.0"

  description          = "Redis cluster"
  engine               = "redis"
  engine_version       = "7.1"
  node_type            = "cache.t3.micro"
  num_cache_clusters   = 2
  replication_group_id = "abc123"
  subnet_ids           = []
  vpc_id               = ""
}

Option 2: Terraform AWS provider resources¶

If you manage resources directly, configure the relevant Terraform AWS provider resources to meet this control. See docs for the resources involved: aws_elasticache_replication_group.

resource "aws_elasticache_replication_group" "this" {
  at_rest_encryption_enabled = true
  auth_token                 = "PofixExampleAuthToken32CharsLng"
  description                = "pofix example replication group"
  replication_group_id       = "pofix-example"
  snapshot_retention_limit   = 15
  transit_encryption_enabled = true

  kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
}

Which option should I choose?

Compliance.tf module (recommended): controls enforced by default and mapped to frameworks.
Open source module (terraform-aws-modules): compatible by design with compliance.tf. Same variable names for an easy, low-change migration path when you are ready.
Terraform AWS provider resources: manage Terraform resources directly.

Tool mappings¶

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf (CTF) Control: elasticache_replication_group_encryption_at_rest_enabled_with_kms_cmk
AWS Config Managed Rule: ELASTICACHE_REPL_GRP_ENCRYPTED_AT_REST
Checkov Check: CKV_AWS_191
Powerpipe Control: aws_compliance.control.elasticache_replication_group_encryption_at_rest_enabled_with_kms_cmk