ElastiCache replication group should have at-rest encryption enabled

What it checks

ElastiCache replication group should have at-rest encryption enabled

Where it applies

Terraform: aws_elasticache_replication_group

CloudFormation: AWS::ElastiCache::ReplicationGroup

How to fix it

1. Set at_rest_encryption_enabled = true. Note: encryption can only be enabled at cluster creation — requires cluster replacement for existing clusters.

Frameworks

• AWS FSBP ElastiCache.4
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules