Find ElastiCache Without Encryption at Rest, in Transit or AUTH

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadCaches",
      "Effect": "Allow",
      "Action": [
        "elasticache:DescribeReplicationGroups",
        "elasticache:DescribeCacheClusters",
        "elasticache:DescribeServerlessCaches"
      ],
      "Resource": "*"
    }
  ]
}

// find-elasticache-clusters-without-encryption.ts
// Report only. Lists ElastiCache replication groups, standalone clusters (including Memcached) and
// serverless caches in each Region, with encryption at rest, encryption in transit and authentication.
// Usage:
//   npx tsx find-elasticache-clusters-without-encryption.ts [--regions us-east-1,eu-west-1] [--csv elasticache.csv]
import { writeFileSync } from "node:fs";
import {
  ElastiCacheClient,
  paginateDescribeCacheClusters,
  paginateDescribeReplicationGroups,
  paginateDescribeServerlessCaches,
} from "@aws-sdk/client-elasticache";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const csvPath = flag("--csv");
const regions = (flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1")
  .split(",")
  .map((r) => r.trim())
  .filter(Boolean);

interface Row {
  Region: string;
  Kind: string;
  Name: string;
  Engine: string;
  AtRest: string;
  InTransit: string;
  Auth: string;
  Findings: string;
}

interface Settings {
  engine: string;
  atRest: boolean | undefined;
  transit: boolean | undefined;
  mode: string | undefined; // "preferred" or "required" when transit encryption is on
  authToken: boolean | undefined;
  userGroups: string[];
}

function evaluate(s: Settings): Pick<Row, "AtRest" | "InTransit" | "Auth" | "Findings"> {
  const memcached = s.engine === "memcached";
  const findings: string[] = [];
  // Node-based Memcached has no at-rest encryption option; only serverless Memcached is encrypted at rest.
  const atRest = memcached ? "n/a" : s.atRest ? "yes" : "NO";
  if (atRest === "NO") findings.push("no encryption at rest (rebuild from backup)");
  let inTransit = "NO";
  if (s.transit) inTransit = s.mode === "preferred" ? "preferred" : "required";
  if (inTransit === "NO") findings.push("no TLS");
  if (inTransit === "preferred") findings.push("TLS preferred: plaintext clients still accepted");
  let auth = "none";
  if (memcached) auth = "n/a";
  else if (s.userGroups.length) auth = `RBAC (${s.userGroups.join(",")})`;
  else if (s.authToken) auth = "AUTH token";
  if (auth === "none") findings.push("no AUTH or RBAC");
  return { AtRest: atRest, InTransit: inTransit, Auth: auth, Findings: findings.join("; ") || "ok" };
}

async function scanRegion(region: string): Promise<Row[]> {
  const ec = new ElastiCacheClient({ region });
  const rows: Row[] = [];

  // Valkey and Redis OSS replication groups (cluster mode enabled or disabled).
  for await (const page of paginateDescribeReplicationGroups({ client: ec }, {})) {
    for (const rg of page.ReplicationGroups ?? []) {
      const engine = rg.Engine ?? "redis";
      rows.push({
        Region: region,
        Kind: "replication group",
        Name: rg.ReplicationGroupId ?? "?",
        Engine: engine,
        ...evaluate({
          engine,
          atRest: rg.AtRestEncryptionEnabled,
          transit: rg.TransitEncryptionEnabled,
          mode: rg.TransitEncryptionMode,
          authToken: rg.AuthTokenEnabled,
          userGroups: rg.UserGroupIds ?? [],
        }),
      });
    }
  }

  // Clusters outside a replication group: Memcached clusters and single-node Valkey or Redis OSS clusters.
  const standalone = paginateDescribeCacheClusters({ client: ec }, { ShowCacheClustersNotInReplicationGroups: true });
  for await (const page of standalone) {
    for (const c of page.CacheClusters ?? []) {
      const engine = c.Engine ?? "?";
      rows.push({
        Region: region,
        Kind: "cluster",
        Name: c.CacheClusterId ?? "?",
        Engine: `${engine} ${c.EngineVersion ?? ""}`.trim(),
        ...evaluate({
          engine,
          atRest: c.AtRestEncryptionEnabled,
          transit: c.TransitEncryptionEnabled,
          mode: c.TransitEncryptionMode,
          authToken: c.AuthTokenEnabled,
          userGroups: [],
        }),
      });
    }
  }

  // Serverless caches always encrypt at rest and in transit, so only the key type and user group are shown.
  for await (const page of paginateDescribeServerlessCaches({ client: ec }, {})) {
    for (const s of page.ServerlessCaches ?? []) {
      rows.push({
        Region: region,
        Kind: "serverless",
        Name: s.ServerlessCacheName ?? "?",
        Engine: s.Engine ?? "?",
        AtRest: s.StorageEncryptionType ?? (s.KmsKeyId ? "sse-kms" : "yes"),
        InTransit: "required",
        Auth: s.UserGroupId ? `RBAC (${s.UserGroupId})` : "no user group",
        Findings: "ok",
      });
    }
  }
  return rows;
}

function toCsv(rows: Row[]): string {
  const cols = Object.keys(rows[0] ?? {}) as (keyof Row)[];
  const cell = (v: string) => `"${v.replace(/"/g, '""')}"`;
  return [cols.join(","), ...rows.map((r) => cols.map((c) => cell(r[c])).join(","))].join("\n") + "\n";
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of regions) {
    try {
      rows.push(...(await scanRegion(region)));
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}`);
    }
  }
  const findings = rows.filter((r) => r.Findings !== "ok");
  console.table(findings.length ? findings : rows);
  console.log(`${rows.length} caches checked, ${findings.length} with findings`);
  if (csvPath && rows.length) {
    writeFileSync(csvPath, toCsv(rows));
    console.log(`Wrote ${rows.length} rows to ${csvPath}`);
  }
  console.log("Report only: nothing was modified.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-elasticache
npm install --save-dev tsx typescript @types/node

AWS_PROFILE=readonly npx tsx find-elasticache-clusters-without-encryption.ts --regions us-east-1,eu-west-1 --csv elasticache.csv

┌─────────┬─────────────┬─────────────────────┬───────────────┬────────────────────┬────────┬─────────────┬──────────────┬────────────────────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Kind                │ Name          │ Engine             │ AtRest │ InTransit   │ Auth         │ Findings                                                               │
├─────────┼─────────────┼─────────────────────┼───────────────┼────────────────────┼────────┼─────────────┼──────────────┼────────────────────────────────────────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'replication group' │ 'sessions'    │ 'redis'            │ 'NO'   │ 'NO'        │ 'none'       │ 'no encryption at rest (rebuild from backup); no TLS; no AUTH or RBAC' │
│ 1       │ 'us-east-1' │ 'replication group' │ 'rate-limits' │ 'valkey'           │ 'yes'  │ 'preferred' │ 'AUTH token' │ 'TLS preferred: plaintext clients still accepted'                      │
│ 2       │ 'eu-west-1' │ 'cluster'           │ 'page-cache'  │ 'memcached 1.6.22' │ 'n/a'  │ 'NO'        │ 'n/a'        │ 'no TLS'                                                               │
└─────────┴─────────────┴─────────────────────┴───────────────┴────────────────────┴────────┴─────────────┴──────────────┴────────────────────────────────────────────────────────────────────────┘
9 caches checked, 3 with findings
Wrote 9 rows to elasticache.csv
Report only: nothing was modified.