AWS ElastiCache Terraform module

Upstream version 1.11.0

7 controls from PCI DSS v4.0 requirements

Terraform Module Source

pcidss.compliance.tf/terraform-aws-modules/elasticache/aws

Compliance Inputs Outputs Resources Diff (1)README

68 unique

Name	Type	Default	Description
Enforced · locked by active controls
at_rest_encryption_enabledelasticache_replication_group_encryption_at_rest_enabled	bool	true	Whether to enable encryption at rest
snapshot_retention_limitelasticache_redis_cluster_automatic_backup_retention_15_days	number	15	(Redis only) Number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them
subnet_group_nameelasticache_cluster_no_default_subnet_group	string	null	The name of the subnet group. If `create_subnet_group` is `true`, this is the name assigned to the subnet group created. Otherwise, this is the name of an existing subnet group
transit_encryption_enabledelasticache_replication_group_encryption_in_transit_enabled	bool	true	Enable encryption in-transit
Optional
apply_immediately	bool	null	Whether any database modifications are applied immediately, or during the next maintenance window. Default is `false`
auth_token	string	null	The password used to access a password protected server. Can be specified only if `transit_encryption_enabled = true`
auth_token_update_strategy	string	null	Strategy to use when updating the `auth_token`. Valid values are `SET`, `ROTATE`, and `DELETE`. Defaults to `ROTATE`
auto_minor_version_upgrade	bool	null	Specifies whether minor version engine upgrades will be applied automatically to the underlying Cache Cluster instances during the maintenance window. Only supported for engine type `redis` and `valkey` and if the engine version is 6 or higher. Defaults to `true`
automatic_failover_enabled	bool	null	Specifies whether a read-only replica will be automatically promoted to read/write primary if the existing primary fails. If true, Multi-AZ is enabled for this replication group. If false, Multi-AZ is disabled for this replication group. Must be enabled for Redis (cluster mode enabled) replication groups
availability_zone	string	null	Availability Zone for the cache cluster. If you want to create cache nodes in multi-az, use `preferred_availability_zones` instead
az_mode	string	null	Whether the nodes in this Memcached node group are created in a single Availability Zone or created across multiple Availability Zones in the cluster's region. Valid values for this parameter are `single-az` or `cross-az`, default is `single-az`
cluster_id	string	""	Group identifier. ElastiCache converts this name to lowercase. Changing this value will re-create the resource
cluster_mode	string	null	Specifies whether cluster mode is enabled or disabled. Valid values are enabled or disabled or compatible
cluster_mode_enabled	bool	false	Whether to enable Redis [cluster mode https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Replication.Redis-RedisCluster.html]
create	bool	true	Determines whether resources will be created (affects all resources)
create_cluster	bool	false	Determines whether an ElastiCache cluster will be created or not
create_parameter_group	bool	false	Determines whether the ElastiCache parameter group will be created or not
create_primary_global_replication_group	bool	false	Determines whether an primary ElastiCache global replication group will be created
create_replication_group	bool	true	Determines whether an ElastiCache replication group will be created or not
create_secondary_global_replication_group	bool	false	Determines whether an secondary ElastiCache global replication group will be created
create_security_group	bool	true	Determines if a security group is created
create_subnet_group	bool	true	Determines whether the Elasticache subnet group will be created or not
data_tiering_enabled	bool	null	Enables data tiering. Data tiering is only supported for replication groups using the `r6gd` node type. This parameter must be set to true when using `r6gd` nodes
description	string	null	User-created description for the replication group
engine	string	"redis"	Name of the cache engine to be used for this cache cluster. Valid values are `memcached`, `redis`, or `valkey`
engine_version	string	null	Version number of the cache engine to be used. If not set, defaults to the latest version
final_snapshot_identifier	string	null	(Redis only) Name of your final cluster snapshot. If omitted, no final snapshot will be made
global_replication_group_id	string	null	The ID of the global replication group to which this replication group should belong
global_replication_group_id_suffix	string	null	The ID suffix of the global replication group
ip_discovery	string	null	The IP version to advertise in the discovery protocol. Valid values are `ipv4` or `ipv6`
kms_key_arn	string	null	The ARN of the key that you wish to use if encrypting at rest. If not supplied, uses service managed encryption. Can be specified only if `at_rest_encryption_enabled = true`
log_delivery_configuration	any	{...}	(Redis OSS or Valkey) Specifies the destination and format of Redis OSS/Valkey SLOWLOG or Redis OSS/Valkey Engine Log
maintenance_window	string	null	Specifies the weekly time range for when maintenance on the cache cluster is performed. The format is `ddd:hh24:mi-ddd:hh24:mi` (24H Clock UTC)
multi_az_enabled	bool	false	Specifies whether to enable Multi-AZ Support for the replication group. If true, `automatic_failover_enabled` must also be enabled. Defaults to `false`
network_type	string	null	The IP versions for cache cluster connections. Valid values are `ipv4`, `ipv6` or `dual_stack`
node_type	string	null	The instance class used. For Memcached, changing this value will re-create the resource
notification_topic_arn	string	null	ARN of an SNS topic to send ElastiCache notifications to
num_cache_clusters	number	null	Number of cache clusters (primary and replicas) this replication group will have. If Multi-AZ is enabled, the value of this parameter must be at least 2. Updates will occur before other modifications. Conflicts with `num_node_groups`. Defaults to `1`
num_cache_nodes	number	1	The initial number of cache nodes that the cache cluster will have. For Redis, this value must be 1. For Memcached, this value must be between 1 and 40. If this number is reduced on subsequent runs, the highest numbered nodes will be removed
num_node_groups	number	null	Number of node groups (shards) for this Redis replication group. Changing this number will trigger a resizing operation before other settings modifications
outpost_mode	string	null	Specify the outpost mode that will apply to the cache cluster creation. Valid values are `single-outpost` and `cross-outpost`, however AWS currently only supports `single-outpost` mode
parameter_group_description	string	null	The description of the ElastiCache parameter group. Defaults to `Managed by Terraform`
parameter_group_family	string	""	The family of the ElastiCache parameter group
parameter_group_name	string	null	The name of the parameter group. If `create_parameter_group` is `true`, this is the name assigned to the parameter group created. Otherwise, this is the name of an existing parameter group
parameters	list(map(string))	[]	List of ElastiCache parameters to apply
port	number	null	The port number on which each of the cache nodes will accept connections. For Memcached the default is `11211`, and for Redis the default port is `6379`
preferred_availability_zones	list(string)	[]	List of the Availability Zones in which cache nodes are created
preferred_cache_cluster_azs	list(string)	[]	List of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is considered. The first item in the list will be the primary node. Ignored when updating
preferred_outpost_arn	string	null	(Required if `outpost_mode` is specified) The outpost ARN in which the cache cluster will be created
replicas_per_node_group	number	null	Number of replica nodes in each node group. Changing this number will trigger a resizing operation before other settings modifications. Valid values are 0 to 5
replication_group_id	string	null	Replication group identifier. When `create_replication_group` is set to `true`, this is the ID assigned to the replication group created. When `create_replication_group` is set to `false`, this is the ID of an externally created replication group
security_group_description	string	null	Description of the security group created
security_group_ids	list(string)	[]	One or more VPC security groups associated with the cache cluster
security_group_name	string	null	Name to use on security group created
security_group_names	list(string)	[]	Names of one or more Amazon VPC security groups associated with this replication group
security_group_rules	any	{}	Security group ingress and egress rules to add to the security group created
security_group_tags	map(string)	{}	A map of additional tags to add to the security group created
security_group_use_name_prefix	bool	true	Determines whether the security group name (`security_group_name`) is used as a prefix
snapshot_arns	list(string)	[]	(Redis only) Single-element string list containing an Amazon Resource Name (ARN) of a Redis RDB snapshot file stored in Amazon S3
snapshot_name	string	null	(Redis only) Name of a snapshot from which to restore data into the new node group. Changing `snapshot_name` forces a new resource
snapshot_window	string	null	(Redis only) Daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. Example: `05:00-09:00`
subnet_group_description	string	null	Description for the Elasticache subnet group
subnet_ids	list(string)	[]	List of VPC Subnet IDs for the Elasticache subnet group
tags	map(string)	{}	A map of tags to add to all resources
timeouts	map(string)	{}	Define maximum timeout for creating, updating, and deleting cluster resource
transit_encryption_mode	string	null	A setting that enables clients to migrate to in-transit encryption with no downtime. Valid values are `preferred` and `required`
user_group_ids	list(string)	null	User Group ID to associate with the replication group. Only a maximum of one (1) user group ID is valid
vpc_id	string	null	Identifier of the VPC where the security group will be created