redis-elasticache-security
>
Works with
--- name: redis-elasticache-security description: > license: Apache-2.0 --- # Redis and ElastiCache Security Amazon ElastiCache for Redis is a managed caching service. It does not have unique security guidelines; instead, apply authentication, networking, and general AWS security controls. ## Authentication - Enable **Redis AUTH** to require a password for client connections - For ElastiCache, use **IAM authentication** where supported to avoid managing static passwords - Rotate AUTH tokens regularly - Never use default or empty passwords ## Encryption ### In Transit - Enable **TLS encryption** for all client-to-cache and replication connections - For ElastiCache, enable in-transit encryption in the replication group or cluster configuration - Applications must use TLS-capable Redis client libraries ### At Rest - For ElastiCache, enable at-rest encryption using **AWS KMS** - Encryption at rest protects backups and snapshots ## Network Isolation - Deploy Redis/ElastiCache in a **private subnet** within a VPC - Configure **security groups** to allow connections only from authorized application instances - Do not expose Redis ports to the public Internet - Use **network ACLs** as an additional layer of defense ## Access Control - Use Redis ACLs (Redis 6+) to create per-application users with minimum required commands and key patterns - Do not use the default user for application access - Disable dangerous commands (`FLUSHALL`, `FLUSHDB`, `CONFIG`, `DEBUG`) in production ## Operational Security - Keep Redis/ElastiCache versions patched and current - Monitor connection patterns and command usage for anomalies - Enable AWS CloudTrail for ElastiCache API activity logging - Configure backup retention and test restore procedures ## Implementation Checklist - [ ] Redis AUTH or IAM authentication is enabled - [ ] TLS is enabled for all client and replication connections - [ ] At-rest encryption is enabled (KMS for ElastiCache) - [ ] Redis is deployed in a private VPC subnet - [ ] Security groups restrict access to authorized instances only - [ ] Redis ACLs are configured with per-application least-privilege users - [ ] Dangerous commands are disabled in production - [ ] Versions are patched and current - [ ] CloudTrail logs ElastiCache API activity ## References - [AWS ElastiCache Security](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/encryption.html) - [Redis Security](https://redis.io/docs/management/security/)
More Database skills
azure-upgrade
microsoft/azure-skills
Assess and upgrade Azure workloads between plans, tiers, or SKUs, or modernize Azure SDK dependencies in source code. WHEN: upgrade Consumption to Flex Consumption, upgrade Azure Functions plan, change hosting plan, function app SKU, migrate App Service to Container Apps, modernize legacy Azure Java SDKs (com.microsoft.azure to com.azure), migrate Azure Cache for Redis (ACR/ACRE) to Azure Managed Redis (AMR).
supabase-postgres-best-practices
supabase/agent-skills
Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill BEFORE writing or changing anything that lives in a Postgres database: creating or altering tables and columns (including choosing column types), schema design, migrations and declarative schema files, RLS policies and the tests that verify them, indexes, triggers, database functions, queues and scheduled jobs (pg_cron, pgmq), vector/semantic search (pgvector), and restoring dumps (pg_restore) or importing data. Also load it when diagnosing slow queries, high CPU, timeouts, EXPLAIN plans, connection exhaustion, locking, bloat, or rows visible to the wrong user or tenant. This is not just a performance guide — schema, migration, security, and SQL authoring tasks need these rules too, even for a one-column change or a single query.
prisma-database-setup
prisma/skills
Guides for configuring Prisma with different database providers (PostgreSQL, MySQL, SQLite, MongoDB, etc.). Use when setting up a new project, changing databases, or troubleshooting connection issues. Triggers on "configure postgres", "connect to mysql", "setup mongodb", "sqlite setup".
