AWS AmazonElastiCache high security documentation change
Summary
Expanded version management documentation to include detailed supported engine versions (Valkey, Redis OSS, Memcached), end-of-life schedules, and security-related features like command renaming and encryption support
Security assessment
The changes include documentation of CVE-2017-9951 fixes in Memcached 1.5.10 and security features like command renaming to prevent accidental data loss (FLUSHALL blocking), ACL improvements in Redis 7.0, and encryption support details. The explicit mention of a CVE fix constitutes concrete evidence of security issue relevance.
Diff
diff --git a/AmazonElastiCache/latest/dg/VersionManagement.md b/AmazonElastiCache/latest/dg/VersionManagement.md index 8205aa8c7..7cc9239bf 100644 --- a//AmazonElastiCache/latest/dg/VersionManagement.md +++ b//AmazonElastiCache/latest/dg/VersionManagement.md @@ -5 +5 @@ -Version management for ElastiCache Serverless CacheVersion management for self-designed ElastiCache clustersUpgrade considerations when working with self-designed clusters +Version management for ElastiCache Serverless CacheVersion management for self-designed ElastiCache clustersSupported versionsSupported Redis OSS versionsRedis OSS versions end of life scheduleSupported Memcached versions @@ -59 +59,520 @@ The value `(max_cache_memory - memcached_connections_overhead)` is the node's me -## Upgrade considerations when working with self-designed clusters +## Supported engines and versions + +ElastiCache serverless caches support ElastiCache version 7.2 for Valkey and above, ElastiCache version 1.6 for Memcached and above, and ElastiCache 7.0 for Redis OSS and above. + +ElastiCache self-designed caches support ElastiCache version 7.2 for Valkey and above, ElastiCache version 1.4.5 for Memcached and above, and ElastiCache 4.0.10 for Redis OSS and above. + +###### Self-designed ElastiCache clusters support the following Valkey versions: + + * Supported Valkey versions + + + + +### Supported Valkey versions + +Supported Valkey versions below. Note that Valkey supports most features available in ElastiCache version 7.2 for Redis OSS by default. + +#### ElastiCache (Valkey) version 8.0 + +Here are some of the new features introduced in Valkey 8.0 (compared to ElastiCache Valkey 7.2.6): + + * Memory efficiency improvements, allowing users to store up to 20% more data per node without any application changes. + + * Newly-introduced per-slot metrics infrastructure for self-designed caches, providing detailed visibility into the performance and resource usage of individual slots. + + * ElastiCache Serverless for Valkey 8.0 can double the supported requests per second (RPS) every 2-3 minutes, reaching 5M RPS per cache from zero in under 13 minutes, with consistent sub-millisecond p50 read latency. + + + + +For more information on Valkey, see [Valkey](https://valkey.io/) + +For more information on the Valkey 8 release, see [Valkey 8 Release Notes](https://github.com/valkey-io/valkey/blob/8.0/00-RELEASENOTES) + +#### ElastiCache version 7.2.6 for Valkey + +On October 10 2024, ElastiCache version 7.2.6 for Valkey was released. Here are some of the new features introduced in 7.2 (compared to ElastiCache version 7.1 for Redis OSS): + + * Performance and memory optimizations for various data types: memory optimization for list and set type keys, speed optimization for sorted sets commands, performance optimization for commands with multiple keys in cluster mode, pub/sub performance improvements, performance optimization for SCAN, SSCAN, HSCAN, ZSCAN commands and numerous other smaller optimizations. + + * New WITHSCORE option for ZRANK and ZREVRANK commands + + * CLIENT NO-TOUCH for clients to run commands without affecting LRU/LFU of keys. + + * New command CLUSTER MYSHARDID that returns the Shard ID of the node to logically group nodes in cluster mode based on replication. + + + + +For more information on Valkey, see [Valkey](https://valkey.io/) + +For more information on the ElastiCache version 7.2 for Valkey release, see [Redis OSS 7.2.4 Release Notes](https://github.com/valkey-io/valkey/blob/d2c8a4b91e8c0e6aefd1f5bc0bf582cddbe046b7/00-RELEASENOTES) (ElastiCache version 7.2 for Valkey includes all changes from ElastiCache version 7.1 for Redis OSS up to ElastiCache version 7.2.4 for Redis OSS). [Valkey 7.2 release notes](https://github.com/valkey-io/valkey/blob/7.2/00-RELEASENOTES) at Valkey on GitHub. + +## Supported Redis OSS versions + +ElastiCache Serverless caches and self-designed caches support all Redis OSS versions 7.1 and before. + + * ElastiCache version 7.1 for Redis OSS (enhanced) + + + + +###### Self-designed ElastiCache clusters support the following Redis OSS versions: + + * ElastiCache version 7.1 for Redis OSS (enhanced) + + * ElastiCache version 7.0 for Redis OSS (enhanced) + + * ElastiCache version 6.2 for Redis OSS (enhanced) + + * ElastiCache version 6.0 for Redis OSS (enhanced) + + * ElastiCache version 5.0.6 for Redis OSS (enhanced) + + * ElastiCache version 5.0.5 for Redis OSS (deprecated, use version 5.0.6) + + * ElastiCache version 5.0.4 for Redis OSS (deprecated, use version 5.0.6) + + * ElastiCache version 5.0.3 for Redis OSS (deprecated, use version 5.0.6) + + * ElastiCache version 5.0.0 for Redis OSS (deprecated, use version 5.0.6) + + * ElastiCache version 4.0.10 for Redis OSS (enhanced) + + * Past End of Life (EOL) versions (3.x) + + * Past End of Life (EOL) versions (2.x) + + + + +### ElastiCache version 7.1 for Redis OSS (enhanced) + +This release contains performance improvements which enable workloads to drive higher throughput and lower operation latencies. ElastiCache version 7.1 for Redis OSS introduces [two main enhancements](https://aws.amazon.com/blogs/database/achieve-over-500-million-requests-per-second-per-cluster-with-amazon-elasticache-for-redis-7-1/) : + +We extended the enhanced I/O threads functionality to also handle the presentation layer logic. By presentation layer, we mean the Enhanced I/O threads which are now not only reading client input, but also parsing the input into Redis OSS binary command format. This is then forwarded to the main thread for execution which provides performance gain. Improved Redis OSS memory access pattern. Execution steps from many data structure operations are interleaved, to ensure parallel memory access and reduced memory access latency. When running ElastiCache on Graviton3-based `R7g.4xlarge` or larger, customers can achieve over 1 million requests per second per node. With the performance improvements to ElastiCache for Redis OSS v7.1, customers can achieve up to 100% more throughput and 50% lower P99 latency relative to ElastiCache for Redis OSS v7.0. These enhancements are enabled on node sizes with at least 8 physical cores (`2xlarge` on Graviton, and `4xlarge` on x86), regardless of the CPU type and require no client changes. + +###### Note + +ElastiCache v7.1 is compatible with Redis OSS v7.0. + +### ElastiCache version 7.0 for Redis OSS (enhanced) + +ElastiCache for Redis OSS 7.0 adds a number of improvements and support for new functionality: + + * [Functions](https://valkey.io/topics/functions-intro/): ElastiCache for Redis OSS 7 adds support for Redis OSS Functions, and provides a managed experience enabling developers to execute [LUA scripts](https://valkey.io/topics/eval-intro/) with application logic stored on the ElastiCache cluster, without requiring clients to re-send the scripts to the server with every connection. + + * [ACL improvements](https://valkey.io/topics/acl/): Valkey and Redis OSS 7 adds support for the next version of Access Control Lists (ACLs). Clients can now specify multiple sets of permissions on specific keys or keyspaces in Valkey and Redis OSS. + + * [Sharded Pub/Sub](https://valkey.io/topics/pubsub/): ElastiCache for Valkey and Redis OSS 7 adds support to run Pub/Sub functionality in a sharded way when running ElastiCache in Cluster Mode Enabled (CME). Pub/Sub capabilities enable publishers to issue messages to any number of subscribers on a channel. Channels are bound to a shard in the ElastiCache cluster, eliminating the need to propagate channel information across shards resulting in improved scalability. + + * Enhanced I/O multiplexing: ElastiCache for Valkey and Redis OSS 7 introduces enhanced I/O multiplexing, which delivers increased throughput and reduced latency for high-throughput workloads that have many concurrent client connections to an ElastiCache cluster. For example, when using a cluster of r6g.xlarge nodes and running 5200 concurrent clients, you can achieve up to 72% increased throughput (read and write operations per second) and up to 71% decreaseed P99 latency, compared with ElastiCache version 6 for Redis OSS. + + + + +For more information on Valkey, see [Valkey](https://valkey.io/). For more information on the Redis OSS 7.0 release, see [Redis OSS 7.0 Release Notes](https://raw.githubusercontent.com/antirez/redis/7.0/00-RELEASENOTES) at Redis OSS on GitHub. + +### ElastiCache version 6.2 for Redis OSS (enhanced) + +ElastiCache for Redis OSS 6.2 includes performance improvements for TLS-enabled clusters using x86 node types with 8 vCPUs or more or Graviton2 node types with 4 vCPUs or more. These enhancements improve throughput and reduce client connection establishment time by offloading encryption to other vCPUs. With Redis OSS 6.2, you can also manage access to Pub/Sub channels with Access Control List (ACL) rules. + +With this version, we also introduce support for data tiering on cluster nodes containing locally attached NVMe SSD. For more information, see [Data tiering in ElastiCache](./data-tiering.html). + +Redis OSS engine version 6.2.6 also introduces support for native JavaScript Object Notation (JSON) format, a simple, schemaless way to encode complex datasets inside Redis OSS clusters. With JSON support, you can leverage the performance and Redis OSS APIs for applications that operate over JSON. For more information, see [Getting started with JSON](./json-gs.html). Also included are JSON-related metrics, `JsonBasedCmds` and `JsonBasedCmdsLatency`, that are incorporated into CloudWatch to monitor the usage of this datatype. For more information, see [Metrics for Valkey and Redis OSS](./CacheMetrics.Redis.html). + +You specify the engine version by using 6.2. ElastiCache will automatically invoke the preferred patch version of Redis OSS 6.2 that is available. For example, when you create/modify a cache cluster, you set the `--engine-version` parameter to 6.2. The cluster will be launched with the current available preferred patch version of Redis OSS 6.2 at the creation/modification time. Specifying engine version 6.x in the API will result in the latest minor version of Redis OSS 6. + +For existing 6.0 clusters, you can opt-in to the next auto minor version upgrade by setting the `AutoMinorVersionUpgrade` parameter to `yes` in the `CreateCacheCluster`, `ModifyCacheCluster`, `CreateReplicationGroup` or `ModifyReplicationGroup` APIs. ElastiCache will upgrade the minor version of your existing 6.0 clusters to 6.2 using self-service updates. For more information, see [Self-service updates in Amazon ElastiCache](./Self-Service-Updates.html). + +When calling the DescribeCacheEngineVersions API, the `EngineVersion` parameter value will be set to 6.2 and the actual engine version with the patch version will be returned in the `CacheEngineVersionDescription` field. + +For more information on the Redis OSS 6.2 release, see [Redis OSS 6.2 Release Notes](https://raw.githubusercontent.com/antirez/redis/6.2/00-RELEASENOTES) at Redis OSS on GitHub. + +### ElastiCache version 6.0 for Redis OSS (enhanced) + +Amazon ElastiCache introduces the next version of ElastiCache for the Redis OSS engine, which includes [Authenticating Users with Role Based Access Control](./Clusters.RBAC.html), client-side caching and significant operational improvements. + +Beginning with Redis OSS 6.0, ElastiCache will offer a single version for each Redis OSS minor release, rather than offering multiple patch versions. ElastiCache will automatically manage the patch version of your running cache clusters, ensuring improved performance and enhanced security. + +You can also opt-in to the next auto minor version upgrade by setting the `AutoMinorVersionUpgrade` parameter to `yes` and ElastiCache will manage the minor version upgrade, through self-service updates. For more information, see [Service updates in ElastiCache](./Self-Service-Updates.html). + +You specify the engine version by using `6.0`. ElastiCache will automatically invoke the preferred patch version of Redis OSS 6.0 that is available. For example, when you create/modify a cache cluster, you set the `--engine-version` parameter to 6.0. The cluster will be launched with the current available preferred patch version of Redis OSS 6.0 at the creation/modification time. Any request with a specific patch version value will be rejected, an exception will be thrown and the process will fail. + +When calling the DescribeCacheEngineVersions API, the `EngineVersion` parameter value will be set to 6.0 and the actual engine version with the patch version will be returned in the `CacheEngineVersionDescription` field. + +For more information on the Redis OSS 6.0 release, see [Redis OSS 6.0 Release Notes](https://raw.githubusercontent.com/antirez/redis/6.0/00-RELEASENOTES) at Redis OSS on GitHub. + +### ElastiCache version 5.0.6 for Redis OSS (enhanced) + +Amazon ElastiCache introduces the next version of ElastiCache for the Redis OSS engine, which includes bug fixes and the following cumulative updates: + + * Engine stability guarantee in special conditions. + + * Improved Hyperloglog error handling. + + * Enhanced handshake commands for reliable replication. + + * Consistent message delivery tracking via `XCLAIM` command. + + * Improved `LFU `field management in objects. + + * Enhanced transaction management when using `ZPOP`. + + * Ability to rename commands: A parameter called `rename-commands` that allows you to rename potentially dangerous or expensive Redis OSS commands that might cause accidental data loss, such as `FLUSHALL` or `FLUSHDB`. This is similar to the rename-command configuration in open source Redis OSS. However, ElastiCache has improved the experience by providing a fully managed workflow. The command name changes are applied immediately, and automatically propagated across all nodes in the cluster that contain the command list. There is no intervention required on your part, such as rebooting nodes. + +The following examples demonstrate how to modify existing parameter groups. They include the `rename-commands` parameter, which is a space-separated list of commands you want to rename: + + aws elasticache modify-cache-parameter-group --cache-parameter-group-name custom_param_group + --parameter-name-values "ParameterName=rename-commands, ParameterValue='flushall restrictedflushall'" --region region + + +In this example, the _rename-commands_ parameter is used to rename the `flushall` command to `restrictedflushall`. + +To rename multiple commands, use the following: + + aws elasticache modify-cache-parameter-group --cache-parameter-group-name custom_param_group + --parameter-name-values "ParameterName=rename-commands, ParameterValue='flushall restrictedflushall flushdb restrictedflushdb''" --region region + + +To revert any change, re-run the command and exclude any renamed values from the `ParameterValue` list that you want to retain, as shown following: + + aws elasticache modify-cache-parameter-group --cache-parameter-group-name custom_param_group + --parameter-name-values "ParameterName=rename-commands, ParameterValue='flushall restrictedflushall'" --region region + + +In this case, the `flushall` command is renamed to `restrictedflushall` and any other renamed commands revert to their original command names. + +###### Note + +When renaming commands, you are restricted to the following limitations: