Cache

1# Compliant fixture — MUST pass (POLICY_OK).
2resource "aws_elasticache_replication_group" "good" {
3  replication_group_id       = "good-redis"
4  description                = "encrypted redis"
5  node_type                  = "cache.t4g.micro"
6  num_cache_clusters         = 2
7  at_rest_encryption_enabled = true
8  transit_encryption_enabled = true
9}
10
11# Variable-driven value must fail open (not flagged).
12resource "aws_elasticache_replication_group" "var_driven" {
13  replication_group_id       = "var-redis"
14  description                = "var-driven"
15  node_type                  = "cache.t4g.micro"
16  num_cache_clusters         = 2
17  at_rest_encryption_enabled = var.encrypt_cache
18}
19
20variable "encrypt_cache" {
21  type    = bool
22  default = true
23}