# Cis AWS Database 5.1

> Ensure Secure Access to ElastiCache

- Skill: `cyberstrikeus/cis-aws-database-5-1` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-aws-database-5-1`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-aws-database-5-1/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-aws-database-5-1

---


# 5.1 Ensure Secure Access to ElastiCache

## Description

Securing access to Amazon ElastiCache involves implementing appropriate authentication and authorization mechanisms.

## Rationale

N/A

## Impact

N/A

## Audit Procedure

### Using AWS Console

1. Use AWS Identity and Access Management (IAM)
   - Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
   - Create IAM users or roles for individuals or applications needing ElastiCache access.
   - Define fine-grained permissions using IAM policies to allow only necessary actions on ElastiCache resources.
   - Assign IAM policies to the IAM users or roles to grant access.

2. Implement Secure Network Access
   - Place your ElastiCache cluster within a Virtual Private Cloud (VPC) to control network access.
   - Create and configure security groups to allow access only from trusted networks or specific IP ranges.
   - Ensure your VPC's network ACLs (Access Control Lists) are properly configured to restrict inbound and outbound traffic.

3. Enable Encryption in Transit
   - Configure your ElastiCache cluster to use SSL/TLS encryption for client connections.
   - Use the `--transit-encryption-enabled` parameter when creating or modifying the cluster to enable encryption in transit.
   - Update your client applications to connect to the ElastiCache cluster using SSL/TLS.

4. Protect ElastiCache Credentials
   - Avoid sharing access keys, secret keys, or IAM user credentials between individuals.
   - Use IAM roles for Amazon EC2 instances or other AWS services to securely access ElastiCache without needing credentials.
   - Rotate your access keys regularly and disable or remove unnecessary IAM users or roles.

5. Enable Event Logging and Monitoring
   - Enable CloudWatch Logs for your ElastiCache clusters to capture logs and monitor activities.
   - Configure CloudWatch Alarms to be notified of any unusual or suspicious behavior.
   - Set up CloudTrail to log API calls made to ElastiCache for auditing and compliance purposes.

6. Regularly Review and Update Access Controls
   - Perform regular reviews of IAM policies, security groups, and network ACLs to ensure they align with your security requirements.
   - Remove any unnecessary or excessive privileges from IAM policies.
   - Stay updated with AWS security best practices and recommendations to improve access controls.

## Expected Result

IAM policies are configured with least privilege access, ElastiCache clusters are in VPCs with proper security groups, encryption in transit is enabled, and logging/monitoring is active.

## Remediation

### Using AWS Console

Follow the same steps as the audit procedure to secure access to ElastiCache clusters.

## Default Value

By default, ElastiCache clusters are accessible within the VPC they are created in, but detailed IAM policies, encryption in transit, and monitoring need to be configured.

## References

1. https://aws.amazon.com/products/databases/

## CIS Controls

| Controls Version | Control                                               | IG 1 | IG 2 | IG 3 |
| ---------------- | ----------------------------------------------------- | ---- | ---- | ---- |
| v8               | 3.3 Configure Data Access Control Lists               | x    | x    | x    |
| v7               | 14.6 Protect Information through Access Control Lists | x    | x    | x    |

## Profile

Level 1 | Manual