AWS AmazonElastiCache medium security documentation change
Summary
Added comprehensive documentation for supported Redis OSS versions including version-specific features, end-of-life schedule, and Memcached version details
Security assessment
The change introduces security documentation for command renaming/blocking (e.g., FLUSHALL mitigation) in Redis 5.0.6, which directly addresses potential security risks from accidental/malicious data loss. It also documents ACL improvements and RBAC features in newer versions.
Diff
diff --git a/AmazonElastiCache/latest/dg/engine-versions.md b/AmazonElastiCache/latest/dg/engine-versions.md index 38fd46f88..47d22f937 100644 --- a//AmazonElastiCache/latest/dg/engine-versions.md +++ b//AmazonElastiCache/latest/dg/engine-versions.md @@ -4,0 +5,2 @@ +Supported Redis OSS versionsRedis OSS versions end of life scheduleSupported Memcached versions + @@ -14,0 +17,6 @@ This section covers the supported Valkey, Memcached, and Redis OSS engines and h + * Supported Redis OSS versions + + * ElastiCache versions for Redis OSS end of life schedule + + * Supported ElastiCache for Memcached versions + @@ -23,0 +32,635 @@ This section covers the supported Valkey, Memcached, and Redis OSS engines and h +## Supported Redis OSS versions + +ElastiCache Serverless caches and self-designed caches support all Redis OSS versions 7.1 and before. + + * ElastiCache version 7.1 for Redis OSS (enhanced) + + + + +###### Self-designed ElastiCache clusters support the following Redis OSS versions: + + * ElastiCache version 7.1 for Redis OSS (enhanced) + + * ElastiCache version 7.0 for Redis OSS (enhanced) + + * ElastiCache version 6.2 for Redis OSS (enhanced) + + * ElastiCache version 6.0 for Redis OSS (enhanced) + + * ElastiCache version 5.0.6 for Redis OSS (enhanced) + + * ElastiCache version 5.0.5 for Redis OSS (deprecated, use version 5.0.6) + + * ElastiCache version 5.0.4 for Redis OSS (deprecated, use version 5.0.6) + + * ElastiCache version 5.0.3 for Redis OSS (deprecated, use version 5.0.6) + + * ElastiCache version 5.0.0 for Redis OSS (deprecated, use version 5.0.6) + + * ElastiCache version 4.0.10 for Redis OSS (enhanced) + + * Past End of Life (EOL) versions (3.x) + + * Past End of Life (EOL) versions (2.x) + + + + +### ElastiCache version 7.1 for Redis OSS (enhanced) + +This release contains performance improvements which enable workloads to drive higher throughput and lower operation latencies. ElastiCache version 7.1 for Redis OSS introduces [two main enhancements](https://aws.amazon.com/blogs/database/achieve-over-500-million-requests-per-second-per-cluster-with-amazon-elasticache-for-redis-7-1/) : + +We extended the enhanced I/O threads functionality to also handle the presentation layer logic. By presentation layer, we mean the Enhanced I/O threads which are now not only reading client input, but also parsing the input into Redis OSS binary command format. This is then forwarded to the main thread for execution which provides performance gain. Improved Redis OSS memory access pattern. Execution steps from many data structure operations are interleaved, to ensure parallel memory access and reduced memory access latency. When running ElastiCache on Graviton3-based `R7g.4xlarge` or larger, customers can achieve over 1 million requests per second per node. With the performance improvements to ElastiCache for Redis OSS v7.1, customers can achieve up to 100% more throughput and 50% lower P99 latency relative to ElastiCache for Redis OSS v7.0. These enhancements are enabled on node sizes with at least 8 physical cores (`2xlarge` on Graviton, and `4xlarge` on x86), regardless of the CPU type and require no client changes. + +###### Note + +ElastiCache v7.1 is compatible with Redis OSS v7.0. + +### ElastiCache version 7.0 for Redis OSS (enhanced) + +ElastiCache for Redis OSS 7.0 adds a number of improvements and support for new functionality: + + * [Functions](https://valkey.io/topics/functions-intro/): ElastiCache for Redis OSS 7 adds support for Redis OSS Functions, and provides a managed experience enabling developers to execute [LUA scripts](https://valkey.io/topics/eval-intro/) with application logic stored on the ElastiCache cluster, without requiring clients to re-send the scripts to the server with every connection. + + * [ACL improvements](https://valkey.io/topics/acl/): Valkey and Redis OSS 7 adds support for the next version of Access Control Lists (ACLs). Clients can now specify multiple sets of permissions on specific keys or keyspaces in Valkey and Redis OSS. + + * [Sharded Pub/Sub](https://valkey.io/topics/pubsub/): ElastiCache for Valkey and Redis OSS 7 adds support to run Pub/Sub functionality in a sharded way when running ElastiCache in Cluster Mode Enabled (CME). Pub/Sub capabilities enable publishers to issue messages to any number of subscribers on a channel. Channels are bound to a shard in the ElastiCache cluster, eliminating the need to propagate channel information across shards resulting in improved scalability. + + * Enhanced I/O multiplexing: ElastiCache for Valkey and Redis OSS 7 introduces enhanced I/O multiplexing, which delivers increased throughput and reduced latency for high-throughput workloads that have many concurrent client connections to an ElastiCache cluster. For example, when using a cluster of r6g.xlarge nodes and running 5200 concurrent clients, you can achieve up to 72% increased throughput (read and write operations per second) and up to 71% decreaseed P99 latency, compared with ElastiCache version 6 for Redis OSS. + + + + +For more information on Valkey, see [Valkey](https://valkey.io/). For more information on the Redis OSS 7.0 release, see [Redis OSS 7.0 Release Notes](https://raw.githubusercontent.com/antirez/redis/7.0/00-RELEASENOTES) at Redis OSS on GitHub. + +### ElastiCache version 6.2 for Redis OSS (enhanced) + +ElastiCache for Redis OSS 6.2 includes performance improvements for TLS-enabled clusters using x86 node types with 8 vCPUs or more or Graviton2 node types with 4 vCPUs or more. These enhancements improve throughput and reduce client connection establishment time by offloading encryption to other vCPUs. With Redis OSS 6.2, you can also manage access to Pub/Sub channels with Access Control List (ACL) rules. + +With this version, we also introduce support for data tiering on cluster nodes containing locally attached NVMe SSD. For more information, see [Data tiering in ElastiCache](./data-tiering.html). + +Redis OSS engine version 6.2.6 also introduces support for native JavaScript Object Notation (JSON) format, a simple, schemaless way to encode complex datasets inside Redis OSS clusters. With JSON support, you can leverage the performance and Redis OSS APIs for applications that operate over JSON. For more information, see [Getting started with JSON](./json-gs.html). Also included are JSON-related metrics, `JsonBasedCmds` and `JsonBasedCmdsLatency`, that are incorporated into CloudWatch to monitor the usage of this datatype. For more information, see [Metrics for Valkey and Redis OSS](./CacheMetrics.Redis.html). + +You specify the engine version by using 6.2. ElastiCache will automatically invoke the preferred patch version of Redis OSS 6.2 that is available. For example, when you create/modify a cache cluster, you set the `--engine-version` parameter to 6.2. The cluster will be launched with the current available preferred patch version of Redis OSS 6.2 at the creation/modification time. Specifying engine version 6.x in the API will result in the latest minor version of Redis OSS 6. + +For existing 6.0 clusters, you can opt-in to the next auto minor version upgrade by setting the `AutoMinorVersionUpgrade` parameter to `yes` in the `CreateCacheCluster`, `ModifyCacheCluster`, `CreateReplicationGroup` or `ModifyReplicationGroup` APIs. ElastiCache will upgrade the minor version of your existing 6.0 clusters to 6.2 using self-service updates. For more information, see [Self-service updates in Amazon ElastiCache](./Self-Service-Updates.html). + +When calling the DescribeCacheEngineVersions API, the `EngineVersion` parameter value will be set to 6.2 and the actual engine version with the patch version will be returned in the `CacheEngineVersionDescription` field. + +For more information on the Redis OSS 6.2 release, see [Redis OSS 6.2 Release Notes](https://raw.githubusercontent.com/antirez/redis/6.2/00-RELEASENOTES) at Redis OSS on GitHub. + +### ElastiCache version 6.0 for Redis OSS (enhanced) + +Amazon ElastiCache introduces the next version of ElastiCache for the Redis OSS engine, which includes [Authenticating Users with Role Based Access Control](./Clusters.RBAC.html), client-side caching and significant operational improvements. + +Beginning with Redis OSS 6.0, ElastiCache will offer a single version for each Redis OSS minor release, rather than offering multiple patch versions. ElastiCache will automatically manage the patch version of your running cache clusters, ensuring improved performance and enhanced security. + +You can also opt-in to the next auto minor version upgrade by setting the `AutoMinorVersionUpgrade` parameter to `yes` and ElastiCache will manage the minor version upgrade, through self-service updates. For more information, see [Service updates in ElastiCache](./Self-Service-Updates.html). + +You specify the engine version by using `6.0`. ElastiCache will automatically invoke the preferred patch version of Redis OSS 6.0 that is available. For example, when you create/modify a cache cluster, you set the `--engine-version` parameter to 6.0. The cluster will be launched with the current available preferred patch version of Redis OSS 6.0 at the creation/modification time. Any request with a specific patch version value will be rejected, an exception will be thrown and the process will fail. + +When calling the DescribeCacheEngineVersions API, the `EngineVersion` parameter value will be set to 6.0 and the actual engine version with the patch version will be returned in the `CacheEngineVersionDescription` field. + +For more information on the Redis OSS 6.0 release, see [Redis OSS 6.0 Release Notes](https://raw.githubusercontent.com/antirez/redis/6.0/00-RELEASENOTES) at Redis OSS on GitHub. + +### ElastiCache version 5.0.6 for Redis OSS (enhanced) + +Amazon ElastiCache introduces the next version of ElastiCache for the Redis OSS engine, which includes bug fixes and the following cumulative updates: + + * Engine stability guarantee in special conditions. + + * Improved Hyperloglog error handling. + + * Enhanced handshake commands for reliable replication. + + * Consistent message delivery tracking via `XCLAIM` command. + + * Improved `LFU `field management in objects. + + * Enhanced transaction management when using `ZPOP`. + + * Ability to rename commands: A parameter called `rename-commands` that allows you to rename potentially dangerous or expensive Redis OSS commands that might cause accidental data loss, such as `FLUSHALL` or `FLUSHDB`. This is similar to the rename-command configuration in open source Redis OSS. However, ElastiCache has improved the experience by providing a fully managed workflow. The command name changes are applied immediately, and automatically propagated across all nodes in the cluster that contain the command list. There is no intervention required on your part, such as rebooting nodes. + +The following examples demonstrate how to modify existing parameter groups. They include the `rename-commands` parameter, which is a space-separated list of commands you want to rename: + + aws elasticache modify-cache-parameter-group --cache-parameter-group-name custom_param_group + --parameter-name-values "ParameterName=rename-commands, ParameterValue='flushall restrictedflushall'" --region region + + +In this example, the _rename-commands_ parameter is used to rename the `flushall` command to `restrictedflushall`. + +To rename multiple commands, use the following: + + aws elasticache modify-cache-parameter-group --cache-parameter-group-name custom_param_group + --parameter-name-values "ParameterName=rename-commands, ParameterValue='flushall restrictedflushall flushdb restrictedflushdb''" --region region + + +To revert any change, re-run the command and exclude any renamed values from the `ParameterValue` list that you want to retain, as shown following: + + aws elasticache modify-cache-parameter-group --cache-parameter-group-name custom_param_group + --parameter-name-values "ParameterName=rename-commands, ParameterValue='flushall restrictedflushall'" --region region + + +In this case, the `flushall` command is renamed to `restrictedflushall` and any other renamed commands revert to their original command names. + +###### Note + +When renaming commands, you are restricted to the following limitations: + + * All renamed commands should be alphanumeric. + + * The maximum length of new command names is 20 alphanumeric characters. + + * When renaming commands, ensure that you update the parameter group associated with your cluster. + + * To prevent a command's use entirely, use the keyword `blocked`, as shown following: + + aws elasticache modify-cache-parameter-group --cache-parameter-group-name custom_param_group + --parameter-name-values "ParameterName=rename-commands, ParameterValue='flushall blocked'" --region region + + +For more information on the parameter changes and a list of what commands are eligible for renaming, see [Redis OSS 5.0.3 parameter changes](./ParameterGroups.Engine.html#ParameterGroups.Redis.5-0-3). + + * Redis OSS Streams: This models a log data structure that allows producers to append new items in real time. It also allows consumers to consume messages either in a blocking or nonblocking fashion. Streams also allow consumer groups, which represent a group of clients to cooperatively consume different portions of the same stream of messages, similar to [Apache Kafka](https://kafka.apache.org/documentation/). For more information, see [Streams](https://valkey.io/topics/streams-intro). + + * Support for a family of stream commands, such as `XADD`, `XRANGE` and `XREAD`. For more information, see [Streams Commands](https://valkey.io/commands/#stream). + + * A number of new and renamed parameters. For more information, see [Redis OSS 5.0.0 parameter changes](./ParameterGroups.Engine.html#ParameterGroups.Redis.5.0). + + * A new Redis OSS metric, `StreamBasedCmds`. + + * Slightly faster snapshot time for Redis OSS nodes. + + + + +###### Important + +ElastiCache has back-ported two critical bug fixes from [Redis OSS open source version 5.0.1](https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES). They are listed following: + + * RESTORE mismatch reply when certain keys have already expired. + + * The `XCLAIM` command can potentially return a wrong entry or desynchronize the protocol. + + + + +Both of these bug fixes are included in ElastiCache for Redis OSS support for Redis OSS engine version 5.0.0 and are consumed in future version updates. + +For more information, see [Redis OSS 5.0.6 Release Notes](https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES) at Redis OSS on GitHub. + +### ElastiCache version 5.0.5 for Redis OSS (deprecated, use version 5.0.6) + +Amazon ElastiCache introduces the next version of ElastiCache for the Redis OSS engine;. It includes online configuration changes for ElastiCache of auto-failover clusters during all planned operations. You can now scale your cluster, upgrade the Redis OSS engine version and apply patches and maintenance updates while the cluster stays online and continues serving incoming requests. It also includes bug fixes. +