AWS securityhub documentation change
Summary
Updated ElastiCache controls documentation to remove references to Valkey in control titles and descriptions, changed the AWS Config rule reference, and clarified that the control evaluates Redis OSS and Valkey replication groups.
Security assessment
The changes refine the scope of existing security controls (e.g., specifying Redis OSS instead of Valkey in titles) and update Config rules, but there is no evidence of addressing a newly discovered vulnerability. The updates clarify existing security best practices (backups, encryption) rather than introducing new security measures.
Diff
diff --git a/securityhub/latest/userguide/elasticache-controls.md b/securityhub/latest/userguide/elasticache-controls.md index ab043cdb3..0c8412fc9 100644 --- a//securityhub/latest/userguide/elasticache-controls.md +++ b//securityhub/latest/userguide/elasticache-controls.md @@ -5 +5 @@ -[ElastiCache.1] ElastiCache (Valkey and Redis OSS) clusters should have automatic backups enabled[ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled[ElastiCache.3] ElastiCache replication groups should have automatic failover enabled[ElastiCache.4] ElastiCache replication groups should be encrypted at rest[ElastiCache.5] ElastiCache replication groups should be encrypted in transit[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled[ElastiCache.7] ElastiCache clusters should not use the default subnet group +[ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled[ElastiCache.2] ElastiCache clusters should have automatic minor version upgrades enabled[ElastiCache.3] ElastiCache replication groups should have automatic failover enabled[ElastiCache.4] ElastiCache replication groups should be encrypted at rest[ElastiCache.5] ElastiCache replication groups should be encrypted in transit[ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled[ElastiCache.7] ElastiCache clusters should not use the default subnet group @@ -11 +11 @@ These AWS Security Hub controls evaluate the Amazon ElastiCache service and reso -## [ElastiCache.1] ElastiCache (Valkey and Redis OSS) clusters should have automatic backups enabled +## [ElastiCache.1] ElastiCache (Redis OSS) clusters should have automatic backups enabled @@ -21 +21 @@ These AWS Security Hub controls evaluate the Amazon ElastiCache service and reso -**AWS Config rule:** [elasticache-automatic-backup-check-enabled](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-automatic-backup-check-enabled.html) +**AWS Config rule:** [elasticache-redis-cluster-automatic-backup-check](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-redis-cluster-automatic-backup-check.html) @@ -31 +31 @@ Parameter | Description | Type | Allowed custom values | Security Hub default va -This control checks whether an Amazon ElastiCache (Valkey or Redis OSS) cluster has automatic backups enabled. The control fails if the `SnapshotRetentionLimit` for the cluster is less than the specified time period. Unless you provide a custom parameter value for the snapshot retention period, Security Hub uses a default value of 1 day. +This control evaluates whether an Amazon ElastiCache (Redis OSS) cluster has automatic backups enabled. The control fails if the `SnapshotRetentionLimit` for the Redis OSS cluster is less than the specified time period. Unless you provide a custom parameter value for the snapshot retention period, Security Hub uses a default value of 1 day. @@ -33 +33 @@ This control checks whether an Amazon ElastiCache (Valkey or Redis OSS) cluster -ElastiCache (Valkey and Redis OSS) clusters can back up their data. You can use the backup to restore a cluster or seed a new cluster. The backup consists of the cluster's metadata, along with all the data in the cluster. All backups are written to Amazon S3, which provides durable storage. You can restore your data by creating a new ElastiCache cluster and populating it with data from a backup. You can manage backups using the AWS Management Console, the AWS CLI, and the ElastiCache API. +ElastiCache (Redis OSS) clusters can back up their data. You can use the backup to restore a cluster or seed a new cluster. The backup consists of the cluster's metadata, along with all the data in the cluster. All backups are written to Amazon S3, which provides durable storage. You can restore your data by creating a new ElastiCache cluster and populating it with data from a backup. You can manage backups using the AWS Management Console, the AWS CLI, and the ElastiCache API. @@ -37,3 +37 @@ ElastiCache (Valkey and Redis OSS) clusters can back up their data. You can use -On October 14, 2025, Security Hub changed the title, description, and rule for this control. Previously, the control checked Redis OSS clusters and all replication groups, using the [elasticache-redis-cluster-automatic-backup-check](https://docs.aws.amazon.com/config/latest/developerguide/elasticache-redis-cluster-automatic-backup-check.html) rule. The title of the control was: _ElastiCache (Redis OSS) clusters should have automatic backups enabled_. - -This control now checks Valkey clusters in addition to Redis OSS clusters and all replication groups. The new title and description reflect that the control checks both types of clusters. +This control also evaluates ElastiCache (Redis OSS and Valkey) replication groups.