Setting the file. One moment.
Chapter 61 · Amazon Elasticache
Subchapter 61.38
references/setup/auth-model-selector.mdMarkdown3 KBView on GitHub
Decision guide for choosing the right authentication model for ElastiCache.
| Auth Model |
|---|
| Where It Fits |
|---|
| Strengths |
|---|
| Constraints |
|---|
| Recommendation |
|---|
| IAM auth + RBAC | Valkey 7.2+ / Redis OSS 7.0+ with cloud-native clients (Lambda, ECS, EKS) | Least-privilege; no password distribution; short-lived credentials; integrates with IAM roles | 15-minute token validity; 12-hour max connection lifecycle; no IAM re-auth inside MULTI/EXEC; requires IAM SDK integration in client | Preferred for new builds when clients support IAM token generation |
| RBAC + passwords in Secrets Manager | Valkey 7.2+ / Redis OSS 6.0+; libraries without IAM-token support; third-party integrations | Per-user ACLs via access strings; rotation via Secrets Manager with a custom Lambda function; works with any client library | Requires Secrets Manager setup and a custom Lambda rotation function; longer-lived credentials than IAM tokens | Preferred alternative when IAM auth is impractical |
| Legacy AUTH token | Node-based clusters only; existing clusters with a single shared password | Simple to configure; supported on older engine versions | Single shared password (up to two tokens during rotation); no per-user ACLs; not available on serverless; no built-in rotation | Never for new builds. Migration path to RBAC only. |
Is this a serverless cache?
Does the client library support IAM token generation?
Is this an existing cluster using a legacy AUTH token?
modify-replication-group --auth-token-update-strategy SET --auth-token <token> to switch from AUTH-only to RBAC-compatible mode. Test RBAC users, then remove the AUTH token.| Use Case | Access String | Notes |
|---|---|---|
| Full access (app) | on ~* +@all | All commands, all keys |
| Read-only | on ~* +@read -@write -@admin | No writes, no admin |
| Scoped to key prefix | on ~app:* +@read +@write | Only keys starting with app: |
| Admin disabled (default user) | off ~* -@all | Locks out the default user |
| Read-only on specific prefix | on ~cache:* +@read | Read-only, scoped keys |