Search code examples
amazon-web-servicesamazon-elasticache

How to enable Encryption in transit for an existing ElastiCache Global Datastore

I have an existing ElastiCache Global Data Store (Redis). I need to enable Encryption in transit . I referred to AWS Documentation , it talks about how to enable for a redis cluster but unable to do the same for my Global Data Store, though i expect the steps to same.

Refer Screenshot below. There is no option to modify or change the encryption details.

enter image description here

Solution

  • I was able to do so by disassociating my cache clusters from the global datastore and then recreate the global datastore.

    Note that following these steps pose an availability risk. You are losing your cross-region availability for the time it takes you to follow this procedure.

    These are the steps I followed:

    1. Remove the secondary regional cluster from your global datastore. This does not delete the cache cluster in the secondary region. So make sure to clean up that cache cluster now or later.
    2. Delete the global datastore. This doesn't delete your primary cache cluster.
    3. Go to the cache cluster on the primary region and modify it. You should be able to enable encryption in-transit now. Note that enabling encryption in-transit is done in two steps. First you need to step encryption in-transit to preferred. Once all of your clients have migrated to use TLS, you can set your encryption in-transit to required.
    4. Recreate the global datastore from an existing cluster. Choose the primary cluster and create a new secondary cluster. The new secondary cluster will be created with encryption in-transit, enabled by default.