Amazon web services – AWS ElastiCache for Redis external consumer authentication options

Is it possible for an external server application (outside of AWS) to authenticate to Elastic Cache for Redis, using a method which is more secure than REDIS Auth token?

Technically, AUTH (or HELLO with an AUTH argument) is the only way you can authenticate on Redis, so your Redis client will have to issue this command anyway.

I assume you wanted to ask if there was an option to authenticate with something more secure than a permanent password.

If your cluster is set to Redis 7, instead of the permanent password, you can use short-lived tokens signed by your IAM role credentials.

Here’s what you need to do:

1. Create an Elasticache user and attach it to your cache.

2. Create an IAM role and grant it elasticache:Connect on the user and the cache (specify the ARNs of both in the Resources section)

3. Generate a URL-like string which would look like this:

   http://{cache}?Action=connect&User={user}&X-Amz-Expires={expiration}[&ResourceType=ServerlessCache]
   

4. Sign this request using the IAM credentials of your role and the service name elasticache

5. Strip the leading http://

6. Pass the resulting string as your AUTH password.

You will have to reconnect to Redis once the signed request expires.

Unfortunately, current versions of the client libraries lack the functionality to sign the requests out of the box.

There is an example for Java, and someone ported it to Go, but I couldn’t find existing libraries for the other languages, so if you’re not using these two, you’ll have to roll your own.