Create Secure Cache

Before provisioning, verify:

Product Rules (check before proceeding)

• Vector search needed? Force node-based Valkey 8.2 or above (recommend 9.0; not available on data-tiering nodes; t2/t3/t4g instances require increased memory reserve). Note: T2 is transitioning to previous-generation. While still available, prefer T3 or T4g for new clusters.
• Global Datastore needed? Force node-based
• Serverless? AUTH tokens not supported. RBAC required. Clients must support cluster mode enabled.
• Node-based? Must explicitly enable: TLS, at-rest encryption, Multi-AZ, automatic failover, daily backups. At-rest encryption is immutable after creation. TLS can be enabled post-creation via a two-step process (set transit-encryption-mode to preferred, then required).

Create the Cache

Serverless

Key differences from node-based:

• Deploys in under a minute
• TLS, encryption at rest, Multi-AZ: all automatic (no flags needed)
• Snapshots are supported but must be explicitly configured via SnapshotRetentionLimit > 0 and optionally DailySnapshotTime. They are not enabled by default.
• Subnet IDs go directly (no subnet group resource needed)
• Must set --cache-usage-limits for cost controls (DataStorage in GB + ECPUPerSecond)
• Primary: aws elasticache create-serverless-cache ... (or boto3 create_serverless_cache, or CloudFormation AWS::ElastiCache::ServerlessCache)

Node-Based

Key differences from serverless:

• Takes 5-15 minutes to provision
• Requires explicit security flags: --transit-encryption-enabled, --at-rest-encryption-enabled, --automatic-failover-enabled, --multi-az-enabled, --snapshot-retention-limit 7
• Requires a subnet group (separate resource)
• For property names per IaC tool, see iac-reference.md
• Primary: aws elasticache create-replication-group ... (Valkey/Redis with replication; or boto3 create_replication_group, or CloudFormation AWS::ElastiCache::ReplicationGroup). Use create-cache-cluster only for Memcached.

VPC-Only Access Notice (mandatory after every creation)

Always tell the user after creating:

Your cache is VPC-only. ElastiCache has no public endpoints. If you are on a local machine, you need a tunnel to connect.

1. Reuse an existing EC2 instance ($0):
   • Primary: python3 scripts/find_tunnel_host.py --vpc-id <vpc-id> --region <region> (locates an SSM-managed instance via boto3)
2. Create a new jump host (approximately $3/month, t4g.nano in us-east-1, pricing subject to change; verify current rates, only if no existing instance found):
   • Primary: launch a t4g.nano with aws ec2 run-instances and attach the AmazonSSMManagedInstanceCore IAM policy so SSM can manage it. Then open the tunnel with python3 scripts/start_tunnel.py. Bills until stopped/terminated.
3. Skip if your app runs inside the VPC (Lambda, ECS, EKS, EC2)

Use the bundled scripts (scripts/find_tunnel_host.py, scripts/start_tunnel.py) as the primary path. Always try option 1 before option 2.

Tunnel startup:

Set Up Authentication

RBAC sequence (both deployment models)

1. Create RBAC user: create-user --user-id <name>-appuser --user-name <name>-appuser --engine <valkey|redis> --access-string "on ~* +@all" --authentication-mode Type=iam
2. Create user group: create-user-group --user-group-id <name>-usergroup --engine <valkey|redis> --user-ids default <name>-appuser

Use the engine value that matches your cache engine (valkey for Valkey caches, redis for Redis OSS caches). 3. Attach to cache:

• Serverless: modify-serverless-cache --serverless-cache-name <name> --user-group-id <name>-usergroup
• Node-based: set --user-group-ids at creation time

Note: The --engine value for user and user-group accepts valkey or redis. Use the value that matches your cache engine.

Authentication mode

Lock down the default user

Always disable the default user: modify-user --user-id default --access-string "off ~* -@all"

Restore from Snapshot

Restore creates a new cache (cannot restore to an existing one). Constraints:

• Backups are cross-compatible between deployment models for Valkey and Redis OSS: node-based snapshots can be restored into serverless caches, and serverless snapshots can be restored into node-based clusters. Memcached serverless snapshots can only be restored into Memcached serverless caches. Serverless restore requires RDB files compatible with Valkey 7.2+ or Redis OSS 5.0+. Data-tiering (r6gd) backups can only restore to r6gd node types.

• CLI commands differ: create-serverless-cache --snapshot-arns-to-restore vs create-replication-group --snapshot-name
• Final snapshot on delete: --final-snapshot-name (serverless) vs --final-snapshot-identifier (node-based). Memcached has no snapshot support; --final-snapshot-identifier does not apply to Memcached.
• Security settings (SGs, encryption, RBAC user groups) are NOT inherited. Must re-specify on the new cache.
• Cross-region snapshot copy: Native cross-region copy API is node-based only. Serverless snapshots can be exported to S3 via export-serverless-cache-snapshot and then copied cross-region through S3.
• S3 export for node-based snapshots uses copy-snapshot --target-bucket. For serverless snapshots, use the separate export-serverless-cache-snapshot --serverless-cache-snapshot-name <name> --s3-bucket-name <bucket> command. Available for Valkey and Redis OSS only (not Serverless Memcached). Bucket needs elasticache.amazonaws.com service principal in its policy.

Validate and Finish

1. Run python3 scripts/test_connection.py <endpoint> (or with --tunnel-mode if local)
2. If validation fails, see connectivity-diagnostics.md
3. Run python3 scripts/security_audit.py --serverless <name> --region <region> to verify security posture
4. Optionally generate observability: python3 scripts/generate_dashboards.py --serverless <name> --region <region>
5. Optionally generate IaC: see iac-reference.md

Attribution Tags

Apply to all resources created by the skill: