Check ElastiCache Backup Retention and Automatic Backups

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadCaches",
      "Effect": "Allow",
      "Action": [
        "elasticache:DescribeReplicationGroups",
        "elasticache:DescribeCacheClusters",
        "elasticache:DescribeServerlessCaches"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SetRetentionWithApply",
      "Effect": "Allow",
      "Action": [
        "elasticache:ModifyReplicationGroup",
        "elasticache:ModifyCacheCluster",
        "elasticache:ModifyServerlessCache"
      ],
      "Resource": [
        "arn:aws:elasticache:us-east-1:111122223333:replicationgroup:*",
        "arn:aws:elasticache:us-east-1:111122223333:cluster:*",
        "arn:aws:elasticache:us-east-1:111122223333:serverlesscache:*"
      ]
    }
  ]
}

// check-elasticache-backups.ts
// Reports the automatic backup settings of every ElastiCache replication group, standalone node-based
// cluster and serverless cache in a Region: backup retention in days (0 = off) and the backup window.
// Report only unless you pass --apply with --ids and --days: then it sets that retention on the caches
// you named (ModifyReplicationGroup, ModifyCacheCluster or ModifyServerlessCache).
// Usage:
//   npx tsx check-elasticache-backups.ts [--region eu-west-1] [--min-days 1]
//   npx tsx check-elasticache-backups.ts --ids sessions-prod,orders-cache --days 7 --apply
import {
  ElastiCacheClient,
  ModifyCacheClusterCommand,
  ModifyReplicationGroupCommand,
  ModifyServerlessCacheCommand,
  paginateDescribeCacheClusters,
  paginateDescribeReplicationGroups,
  paginateDescribeServerlessCaches,
} from "@aws-sdk/client-elasticache";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const region = flag("--region") ?? process.env.AWS_REGION ?? "us-east-1";
const minDays = Number(flag("--min-days") ?? "1");
const ids = new Set((flag("--ids") ?? "").split(",").map((s) => s.trim()).filter(Boolean));
const days = Number(flag("--days") ?? "0");
const apply = args.includes("--apply");
const ec = new ElastiCacheClient({ region });

type Kind = "replication group" | "cluster" | "serverless";
interface Row {
  Id: string;
  Kind: Kind;
  Engine: string;
  RetentionDays: number | string;
  Window: string;
  Status: string;
}

function verdict(retention: number | undefined): string {
  if (!retention) return "BACKUPS OFF";
  return retention < minDays ? `below ${minDays} days` : "ok";
}

async function main(): Promise<void> {
  if (apply && (ids.size === 0 || !Number.isInteger(days) || days < 1 || days > 35)) {
    console.error("--apply needs --ids and --days between 1 and 35.");
    process.exit(1);
  }
  const rows: Row[] = [];

  for await (const page of paginateDescribeReplicationGroups({ client: ec }, {})) {
    for (const rg of page.ReplicationGroups ?? []) {
      if (!rg.ReplicationGroupId) continue;
      rows.push({
        Id: rg.ReplicationGroupId,
        Kind: "replication group",
        Engine: rg.Engine ?? "redis",
        RetentionDays: rg.SnapshotRetentionLimit ?? 0,
        Window: rg.SnapshotWindow ?? "-",
        Status: verdict(rg.SnapshotRetentionLimit),
      });
    }
  }

  // Node-based clusters that aren't part of a replication group: standalone Valkey/Redis OSS or Memcached.
  for await (const page of paginateDescribeCacheClusters({ client: ec }, {})) {
    for (const c of page.CacheClusters ?? []) {
      if (!c.CacheClusterId || c.ReplicationGroupId) continue;
      const memcached = c.Engine === "memcached";
      rows.push({
        Id: c.CacheClusterId,
        Kind: "cluster",
        Engine: c.Engine ?? "?",
        RetentionDays: memcached ? "n/a" : (c.SnapshotRetentionLimit ?? 0),
        Window: memcached ? "-" : (c.SnapshotWindow ?? "-"),
        Status: memcached ? "no backups for node-based Memcached" : verdict(c.SnapshotRetentionLimit),
      });
    }
  }

  for await (const page of paginateDescribeServerlessCaches({ client: ec }, {})) {
    for (const s of page.ServerlessCaches ?? []) {
      if (!s.ServerlessCacheName) continue;
      rows.push({
        Id: s.ServerlessCacheName,
        Kind: "serverless",
        Engine: s.Engine ?? "?",
        RetentionDays: s.SnapshotRetentionLimit ?? 0,
        Window: s.DailySnapshotTime ? `daily at ${s.DailySnapshotTime}` : "-",
        Status: verdict(s.SnapshotRetentionLimit),
      });
    }
  }

  if (apply) {
    for (const row of rows.filter((r) => ids.has(r.Id))) {
      try {
        if (row.Kind === "replication group") {
          await ec.send(new ModifyReplicationGroupCommand({ ReplicationGroupId: row.Id, SnapshotRetentionLimit: days }));
        } else if (row.Kind === "serverless") {
          await ec.send(new ModifyServerlessCacheCommand({ ServerlessCacheName: row.Id, SnapshotRetentionLimit: days }));
        } else if (row.RetentionDays !== "n/a") {
          await ec.send(new ModifyCacheClusterCommand({ CacheClusterId: row.Id, SnapshotRetentionLimit: days }));
        } else {
          continue;
        }
        row.Status = `retention set to ${days} days`;
      } catch (err) {
        row.Status = `error: ${err instanceof Error ? err.name : String(err)}`;
      }
    }
  }

  const off = rows.filter((r) => r.RetentionDays === 0).length;
  console.log(`ElastiCache caches in ${region}: ${rows.length}; automatic backups off: ${off}`);
  if (rows.length) console.table(rows);
  if (!apply) console.log("Report only. Pass --ids, --days and --apply to change backup retention.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-elasticache
npm install --save-dev tsx typescript @types/node

# Report, flag anything kept for less than 7 days
AWS_PROFILE=readonly npx tsx check-elasticache-backups.ts --region us-east-1 --min-days 7

# Turn on 7-day retention for two caches
AWS_PROFILE=cache-admin npx tsx check-elasticache-backups.ts --region us-east-1 --ids sessions-prod,api-rate-limits --days 7 --apply

ElastiCache caches in us-east-1: 6; automatic backups off: 3
┌─────────┬─────────────────────┬─────────────────────┬─────────────┬───────────────┬──────────────────┬───────────────────────────────────────┐
│ (index) │ Id                  │ Kind                │ Engine      │ RetentionDays │ Window           │ Status                                │
├─────────┼─────────────────────┼─────────────────────┼─────────────┼───────────────┼──────────────────┼───────────────────────────────────────┤
│ 0       │ 'sessions-prod'     │ 'replication group' │ 'valkey'    │ 0             │ '05:00-06:00'    │ 'BACKUPS OFF'                         │
│ 1       │ 'orders-cache'      │ 'replication group' │ 'redis'     │ 1             │ '03:30-04:30'    │ 'below 7 days'                        │
│ 2       │ 'leaderboard'       │ 'replication group' │ 'valkey'    │ 7             │ '02:00-03:00'    │ 'ok'                                  │
│ 3       │ 'catalog-memcached' │ 'cluster'           │ 'memcached' │ 'n/a'         │ '-'              │ 'no backups for node-based Memcached' │
│ 4       │ 'legacy-redis'      │ 'cluster'           │ 'redis'     │ 0             │ '07:00-08:00'    │ 'BACKUPS OFF'                         │
│ 5       │ 'api-rate-limits'   │ 'serverless'        │ 'valkey'    │ 0             │ 'daily at 04:00' │ 'BACKUPS OFF'                         │
└─────────┴─────────────────────┴─────────────────────┴─────────────┴───────────────┴──────────────────┴───────────────────────────────────────┘
Report only. Pass --ids, --days and --apply to change backup retention.