A company is running an application that uses an Amazon ElastiCache for Redis cluster as a caching layer A recent security audit revealed that the…

This solution correctly addresses all requirements. For Amazon ElastiCache for Redis, user authentication is implemented using the Redis AUTH command with a token (password). Storing this token securely in AWS Systems Manager Parameter Store as an encrypted parameter is a best practice. Crucially, enabling encryption in transit on an ElastiCache for Redis cluster is an operation that can only be performed at creation time. Therefore, a new cluster must be created with both AUTH and encryption in transit enabled. The application is then updated to retrieve the token from Parameter Store and use it to connect to the new, secure cluster.

B. This option is incorrect because you cannot enable encryption in transit on an existing ElastiCache for Redis cluster. A new cluster must be created.

C. This option is incorrect because it proposes using SSL certificates for user authentication. The standard authentication mechanism for ElastiCache for Redis is the AUTH token.

D. This option is incorrect for two reasons: it suggests using an incorrect authentication method (SSL certificates) and incorrectly states that an existing cluster can be updated to enable encryption in transit.

---

1. AWS ElastiCache for Redis Documentation

"Authenticating Users with the Redis AUTH Command": This document specifies that the AUTH command is the method for authenticating users. It states

"When you enable Redis AUTH

you require users to enter a password before they are allowed to execute Redis commands." This supports the use of an AUTH token as described in option A.

Source: AWS Documentation > ElastiCache > User Guide > Managing Access > Authenticating Users with the Redis AUTH Command.

2. AWS ElastiCache for Redis Documentation

"Encryption in transit (TLS)": This official documentation explicitly states that in-transit encryption cannot be enabled on an existing cluster. "You can enable in-transit encryption only when you create a Redis replication group. You can't enable it on an existing replication group." This directly invalidates options B and D.

Source: AWS Documentation > ElastiCache > User Guide > Data Security in Amazon ElastiCache > Encryption in transit (TLS).

3. AWS Systems Manager Documentation

"AWS Systems Manager Parameter Store": This document describes using Parameter Store to securely store configuration data and secrets. The SecureString parameter type uses AWS KMS to encrypt the parameter value

making it a suitable and secure location for storing the Redis AUTH token.

Source: AWS Documentation > Systems Manager > User Guide > Parameter Store.