First AUTH token update should remove passwordless access

What it checks

ElastiCache replication group: adding the first AUTH token with ROTATE retains passwordless access.

Where it applies

Terraform: aws_elasticache_replication_group

CloudFormation: AWS::ElastiCache::ReplicationGroup

How to fix it

1. Verify the exact instance's prior authentication state. Migrate clients to token authentication, then use SET to remove passwordless access; plan client compatibility before changing the strategy.

Frameworks

• SOC 2 CC6.1

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules