ElastiCache replication group should require AUTH or RBAC

What it checks

ElastiCache replication group: TLS is enabled but neither AUTH nor effective RBAC protection is demonstrated.

Where it applies

Terraform: aws_elasticache_replication_group

CloudFormation: AWS::ElastiCache::ReplicationGroup

How to fix it

1. Set auth_token to a random 16-64 character string stored in Secrets Manager. Rotate via the ElastiCache modify-replication-group API.

Frameworks

• AWS FSBP ElastiCache.6
• SOC 2 CC6.1
• PCI-DSS v4.0.1/8.3.1

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules