Control: 3 ElastiCache for Redis replication groups should have automatic failover enabled

Description

This control checks if ElastiCache for Redis replication groups have automatic failover enabled. This control fails if automatic failover isn't enabled for a Redis replication group.

When automatic failover is enabled for a replication group, the role of primary node will automatically fail over to one of the read replicas. This failover and replica promotion ensure that you can resume writing to the new primary after promotion is complete, which reduces overall downtime in case of failure.

Remediation

To enable automatic failover for an existing ElastiCache for Redis replication group,, see Modifying an ElastiCache cluster in the Amazon ElastiCache User Guide. If you use the ElastiCache console, set Auto failover to enabled.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_elasticache_3

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_elasticache_3 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when automatic_failover = 'enabled' then 'ok'
    else 'alarm'
  end as status,
  case
    when automatic_failover = 'enabled' then title || ' automatic failover enabled.'
    else title || ' automatic failover disabled.'
  end as reason
  , region, account_id
from
  aws_elasticache_replication_group;

Control: 3 ElastiCache for Redis replication groups should have automatic failover enabled

Description

Remediation

Usage

SQL

Tags