Check provider logo

ElastiCache Redis cache cluster has automated snapshot backups enabled with retention of at least 7 days

elasticache_redis_cluster_backup_enabled

Severityhigh
by Prowler

Amazon ElastiCache Redis replication groups have automated snapshot backups enabled with a retention period of at least 7 days.

The evaluation focuses on whether backups are enabled and the configured retention meets the minimum threshold.

Risk

Absent or short-retained backups degrade availability and heighten data loss risk. Hardware failures, corruption, or accidental deletes may not be recoverable to needed points, undermining RPO/RTO, prolonging outages, and limiting forensics on cache data.

Run this check with Prowler CLI

prowler aws --checks elasticache_redis_cluster_backup_enabled

Recommendation

Enable automated backups and set retention to meet RPO/RTO (typically 7 days).

  • Define a consistent snapshot window
  • Test restores regularly
  • Protect backup storage with least privilege and immutability
  • Monitor backup status for failures
  • Apply defense in depth with replicas/Multi-AZ

Remediation

CLI

aws elasticache modify-replication-group --replication-group-id <REPLICATION_GROUP_ID> --snapshot-retention-limit 7 --apply-immediately

Native IaC
Terraform
Other
  1. In the AWS Console, open ElastiCache
  2. Go to Redis > Replication groups
  3. Select <example_resource_id> and click Modify
  4. Set Snapshot retention (days) to 7 or higher
  5. Check Apply immediately
  6. Click Modify to save

Source Code

Resource Type

Other

References