AWS ElasticCache Redis Project
AWS ElastiCache serves as a managed, in-memory caching service designed to enhance database performance by reducing operational load and providing low-latency data access. The following paragraphs outline the step-by-step creation of a Redis cluster in AWS, highlighting the choice between serverless and node-based deployments as well as the importance of security groups and encryption.
To ensure secure connectivity, we will see how to configure an Amazon EC2 instance as a client since ElasticCache cannot be accessed directly from the public internet. We will do a manual installation of redis-cli on Linux, involving the compilation of source code and the setup of necessary dependencies. The following paragraphs demonstrates practical usage by connecting to the cluster with an authentication token and executing basic commands to store, retrieve, and expire data in ElasticCache.
The role of Amazon ElasticCache is a fully managed, in-memory caching service that acts as an ultra-low latency cache in front of your primary database (e.g., Amazon RDS).
The Problem: High volumes of repetitive query requests (especially read-only operations) put heavy computational and I/O load on primary transactional databases.
The Solution: Integrating ElasticCache in front of the database enables the application to check the cache first. If a cache hit occurs, ElasticCache returns the results with sub-millisecond response times. If a cache miss occurs, the query runs on the primary database, and the application populates the cache with the result for future requests, drastically offloading operations and saving database scaling costs.
Part 1: Provisioning the AWS ElasticCache Redis Cluster
Step 1.1: Initiate Creation in the AWS Management Console. Search for and navigate to the Amazon ElasticCache dashboard.
On the landing page or sidebar, click Get Started or click Redis clusters -> Create Redis cluster.
Step 1.2: Choose Deployment and Design Under Cluster settings, select Design your own cache.
Deployment option: Select Amazon ElasticCache (Redis).
Environment: Select the Dev/test option.
Name: Enter a descriptive name, such as my-redis-instance.
Description: Input a short summary, e.g., my redis cluster.
IP address type: Select IPv4.
Step 1.3: Configure Cluster Mode and Node Details Cluster Mode: Uncheck/Disable Cluster Mode.
Why: Disabling Cluster Mode configures the deployment to run as a single node group with one Primary read/write node and optional read replica nodes. This is simpler for dev/test environments and single-node setups.
Name (under cluster settings): Enter my red.
Description: Enter my redis instance.
Location: Select AWS Cloud. AWS Outpost is only selected if you are placing the hardware rack inside an on-premises physical environment for hybrid environments.
Multi-AZ: Keep unchecked (disabled) for test environments.
Note: For high-availability production environments, Multi-AZ is highly recommended.
When enabled, AWS automatically detects primary node failures and promotes a read replica to primary (Auto-Failover).
Engine Version: Select 7.0.
Port: Retain the default Redis port of 6379.
Parameter Group: Retain the automatically created default parameter group
Node Type: Choose cache.r5.large
Number of Replicas: Set to 2.
This provisions one primary node and two read replica nodes for demonstrating replication.
Step 1.4: Network & Subnet Group Configuration Subnet Group: Select Create a new subnet group
Name: Name it redis subnet group
VPC: Choose your Default VPC (or the target VPC where your database and application instances reside)
Subnets Selection: Select subnets in at least two Availability Zones to support multi-AZ layouts.
Availability Zone Placement: Set Primary node placement to AP South 1a. Set Replica node placement to AP South 1b or in your preferred region
Step 1.5: Configure Security, Encryption & Redis AUTH
Click Next to proceed to the security configurations
Encryption at Rest: Check Enable encryption at rest
Select the default AWS-managed key (or a customer-managed KMS key) to secure stored cache blocks.
Encryption in Transit: Check Enable encryption in transit.
Why: Encrypting connections in transit is a security prerequisite that also unlocks the access control options.
Access Control:
Under Authentication and authorization, select Redis AUTH.
Redis AUTH Token: Provide a secure password/token.
Constraint: The Redis AUTH token must be a string of at least 16 characters.
Step 1.6: Associate Security Group
Create Security Group (via EC2 console)
Open the EC2 console in a new browser tab, go to Security Groups -> Create Security Group
Name: Name it 'SG for redis'
VPC: Ensure it is mapped to the same VPC as your Redis cluster
Inbound Rules: Add a rule with the following parameters:
Type: Custom TCP.
Port Range: 6379.
Source: Anywhere (0.0.0.0/0) for the initial setup phase
Save and create the security group
Select Security Group in ElastiCache Wizard: Go back to your ElastiCache configuration wizard
Under Security Groups, click Manage or click the refresh icon
Locate and select your newly created SG group, and click Choose
Step 1.7: Backups, Logging & Finalization
Automatic Backups: Disable automatic backups for sandbox testing (keep unchecked)
Maintenance Window: Select No preference and leave "Auto minor version upgrade" enabled
CloudWatch Logs: Enable logging to inspect Redis cluster operations.
Slow Logs: Check to enable. Set format to JSON or Text and choose CloudWatch Logs as destination.
Log Group Name: Create a new log group called redis slow logs.
Click Next to proceed to the review screen, verify your configurations, and click Create
AWS will initiate provisioning. Under Nodes, you will see two nodes: 001 (Primary) and 002 (Read Replica) in a "Creating" status.
Part 2: Provisioning an EC2 Instance inside the VPC
AWS VPC Isolation Rule: Amazon ElastiCache is architected to be highly secure and completely private inside your VPC. You cannot directly connect to ElastiCache from outside the VPC (like your local laptop's command line or a local application) without deploying a dedicated NAT instance, which is not recommended for production due to high latency and complexity. The standard, secure way to access and test ElastiCache is by deploying an EC2 instance within the same VPC.
Step 2.1: Launch the EC2 Instance
Go to the EC2 Dashboard and click Launch Instance
Name: redis CLI instance
OS / AMI: Select Amazon Linux 2 AMI.
Critical Choice: Select Amazon Linux 2 instead of Amazon Linux 2023. Linux 2023 lacks traditional package manager patterns like yum, making compiled installs more complex.
Instance Type: Select t2.micro (this is fully sufficient for acting as a command-line client).
Key Pair: Select or generate a key pair and download your private .pem key file.
Network Settings: VPC: Ensure you select the same VPC where your Redis cluster is currently launching.
Subnet: Select a public subnet so you can SSH into the instance from your local laptop.
Auto-assign Public IP: Enable.
Security Group: Create a new security group that allows inbound SSH traffic on port 22 from your IP address.
Click Launch Instance.
Step 2.2: Establish SSH Connection and Elevate Privileges Locate your downloaded private key (.pem) file on your local machine.
Open your desktop terminal, navigate to the folder containing your key, and execute the SSH command: ssh -i .pem ec2-userIP Address
Type yes when prompted to verify the SSH key fingerprint.
Once logged in as ec2-user, elevate your privileges to root to install system packages and compile files globally: sudo su
Part 3: Compiling and Installing redis-cli from Source
The redis-cli client is not distributed directly as an Amazon Linux 2 native RPM package. To install it, you must download the official stable Redis source code and build/compile the binary on your instance.
Step 3.1: Install Compilation Dependencies Update and enable the EPEL (Extra Packages for Enterprise Linux) repository on your Amazon Linux 2 instance: amazon-linux-extras install epel -y
Install the necessary development tools, including the GCC compiler, a memory allocator, and the OpenSSL development libraries (which are crucial for compiling redis-cli with TLS support):
yum install -y gcc openssl-devel
Step 3.2: Download and Extract Redis Code Use wget to pull the stable Redis code archive from the official Redis website:
wget http://download.redis.io/redis-stable.tar.gz
Extract the downloaded gzipped tarball: tar -xvzf redis-stable.tar.gz
Verify extraction by listing the files: ls You will see the newly created redis-stable folder.
Step 3.3: Compile the Binary Change directory into the source folder:
cd redis-stable
Run the make utility to compile the executable: make
The compiler will build the Redis utilities. This build takes approximately 4 to 5 minutes to finish.
Optimization Note: Skip running make test. While make test verifies the compilation, it takes an additional 5 to 10 minutes and is unnecessary for sandbox environments.
Step 3.4: Make the command globally available Verify the compiled files inside the src directory: ls src
You will find the compiled binary named redis-cli.
Setting Global Executability: If you try running redis-cli from any directory, you will get a "command not found". To avoid having to prefix your command with local paths like ./src/redis-cli, copy the executable to /usr/bin/ so the OS system PATH can recognize it globally: cp src/redis-cli /usr/bin/ Confirm global registration by executing: redis-cli The system should recognize the command. Part 4: Securing Security Group Rules before connecting, secure your environment by restricting incoming cluster queries to the EC2 instance.
Identify the Security Group ID of your EC2 client instance (e.g., sg-0xxxxxxxxxxxxxx) in your AWS EC2 Console and note the same. Open the EC2 Dashboard, select Security Groups, and find your Redis security group.
Click Edit Inbound Rules. Locate the inbound rule for Custom TCP Port 6379. Under Source, delete 0.0.0.0/0 (Anywhere). In its place, search for and select your EC2 Security Group ID. Save the inbound rules.
This isolates your Redis cluster, preventing any unauthorized resources from attempting connections.
Part 5: Connecting to the Cluster with redis-cli
Step 5.1: Retrieve the Cluster Primary Endpoint Navigate back to the Amazon ElastiCache dashboard in the AWS Console. Select your cluster. Under the cluster details, look for the Primary Endpoint. Copy the primary endpoint string.
CRITICAL STEP: Delete the trailing :6379 port suffix from your copied endpoint string. The redis-cli uses separate flags to denote the host and the port, and passing the port in the host argument will trigger a resolution failure.
Step 5.2: Verify Network Resolution Before executing the connection command, run nslookup from your EC2 root shell to verify that your EC2 client can successfully resolve the cluster's private IP addresses:
nslookup This should output the canonical name (CNAME) and the private IP address mapping of your Redis cluster.
Step 5.3: Run the Connection Command Connect using your globally-registered redis-cli, adding the appropriate SSL and password arguments:
redis-cli -h --tls -a -p 6379 Breakdown of CLI Parameters: -h: Specifies the target hostname (your primary endpoint string with the :6379 removed) [26, 30]. --tls: Enforces an SSL/TLS connection. Because "Encryption in Transit" was enabled, standard non-encrypted connections are blocked; you must use this flag to establish a handshake. -a: Passes your Redis AUTH password token. -p: Directs traffic to Redis port 6379. Avoid -c: Do not pass the -c flag. This flag is used for Cluster Mode redirections, which is not applicable since Cluster Mode was disabled during creation. When successfully executed, the terminal prompt will transform, indicating you have connected to the Redis console:
Part 6: Interacting and Testing Redis Inside the interactive Redis CLI, execute the following commands to verify caching performance and operations:
- Set and Retrieve standard Key-Value Pairs Add a simple string value to a key named a:
set a "Cat" Output: OK
Retrieve the string value from key a:
get a Output: "Cat"