Skip to main content

​
Triage and Remediation

  • Remediation

​
Remediation

Using Console

To remediate the misconfiguration of Elasticache not being encrypted at rest and in transit in AWS, you can follow the below steps:
  1. Log in to your AWS console.
  2. Go to the Elasticache service.
  3. Select the cluster that you want to encrypt.
  4. Click on the “Modify” button.
  5. Scroll down to the “Advanced Redis Settings” section.
  6. Enable the “Encryption in transit” option.
  7. Select the “Require encryption” option.
  8. Enable the “Encryption at rest” option.
  9. Select the “AWS managed CMK” option.
  10. Click on the “Save Changes” button.
After completing the above steps, your Elasticache cluster will be encrypted at rest and in transit using AWS managed CMK.

​

To remediate Elasticache misconfiguration for AWS using AWS CLI, you can follow the below steps:
  1. First, you need to enable encryption at rest for Elasticache using AWS CLI. You can do this by running the following command:
aws elasticache modify-cache-cluster --cache-cluster-id <CACHE_CLUSTER_ID> --transit-encryption-enabled --at-rest-encryption-enabled --security-group-ids <SECURITY_GROUP_IDS>
In the above command, replace <CACHE_CLUSTER_ID> with the ID of the Elasticache cluster that you want to modify and <SECURITY_GROUP_IDS> with the IDs of the security groups that you want to associate with the cluster.
  1. After enabling encryption at rest, you need to enable encryption in transit for Elasticache using AWS CLI. You can do this by running the following command:
aws elasticache modify-cache-cluster --cache-cluster-id <CACHE_CLUSTER_ID> --cache-security-group-names <CACHE_SECURITY_GROUP_NAMES> --security-group-ids <SECURITY_GROUP_IDS> --apply-immediately
In the above command, replace <CACHE_CLUSTER_ID> with the ID of the Elasticache cluster that you want to modify, <CACHE_SECURITY_GROUP_NAMES> with the names of the cache security groups that you want to associate with the cluster, and <SECURITY_GROUP_IDS> with the IDs of the security groups that you want to associate with the cluster.
  1. Finally, verify that the Elasticache cluster is encrypted at rest and in transit. You can do this by running the following command:
aws elasticache describe-cache-clusters --cache-cluster-id <CACHE_CLUSTER_ID>
In the output of the above command, verify that the TransitEncryptionEnabled and AtRestEncryptionEnabled values are set to true.By following the above steps, you can remediate the Elasticache misconfiguration for AWS using AWS CLI.
To remediate the misconfiguration in AWS Elasticache, you can use Python and follow these steps:
  1. Open the AWS Elasticache console and select the cluster that you want to remediate.
  2. Click on the “Security” tab and select the “Encryption in transit” option.
  3. Enable encryption in transit by selecting the “Enable encryption in transit” checkbox.
  4. Select the appropriate security group for your cluster.
  5. Choose the SSL/TLS certificate that you want to use for encryption in transit.
  6. Click on the “Save” button to save the changes.
  7. Next, click on the “Encryption at rest” option.
  8. Enable encryption at rest by selecting the “Enable encryption at rest” checkbox.
  9. Choose the KMS key that you want to use for encryption at rest.
  10. Click on the “Save” button to save the changes.
  11. To automate the remediation process using Python, you can use the AWS SDK for Python (Boto3).
  12. Install the Boto3 library using pip: pip install boto3
  13. Create an AWS session using the boto3.Session() method.
  14. Create an Elasticache client using the session.client('elasticache') method.
  15. Use the modify_cache_cluster() method of the Elasticache client to update the cluster configuration.
  16. Set the TransitEncryptionEnabled parameter to True to enable encryption in transit.
  17. Set the AtRestEncryptionEnabled parameter to True to enable encryption at rest.
  18. Set the KmsKeyId parameter to the ARN of the KMS key that you want to use for encryption at rest.
  19. Call the modify_cache_cluster() method to apply the changes to the cluster.
Here’s some sample Python code that you can use to remediate the misconfiguration:
import boto3

# Create an AWS session
session = boto3.Session()

# Create an Elasticache client
elasticache = session.client('elasticache')

# Update the cluster configuration
response = elasticache.modify_cache_cluster(
    CacheClusterId='my-cluster',
    TransitEncryptionEnabled=True,
    AtRestEncryptionEnabled=True,
    KmsKeyId='arn:aws:kms:us-west-2:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234'
)

# Print the response
print(response)
Note: Replace my-cluster with the name of your Elasticache cluster and arn:aws:kms:us-west-2:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234 with the ARN of your KMS key.
⌘I