AWS Elasticache support for Redis

 AWS launched Elasticache (EC) support for Redis. Redis is a fast, open-source, in-memory, key-value data store. Because of its fast performance, Redis is a popular choice for caching.

An EC cluster Redis can be created with a different structure.  

Single node. There is a one-to-one relationship between a node and a cache cluster.

Cluster with Replica Nodes - cluster mode disabled. The cluster supports replication with a single shard

Cluster with Replica Nodes - cluster mode enabled. The cluster supports replication with multiple shards

Security and Encryption

The service offers encryption In transit and at rest. Redis AUTH for secure internode communications helps keep sensitive data safe. User groups can be used to set up user group based access control. 

Different terminology between AWS Console and API/CLI.

AWS uses a different terminology between AWS Console and API/CLI.

Multi AZ and Autofailover

When Multi-AZ is enabled

1. ElastiCache detects the primary node failure.
2. ElastiCache promotes the read replica node with the least replication lag to primary node.
3. The other replicas sync with the new primary node.
4. ElastiCache spins up a read replica in the failed primary's AZ.
5. The new node syncs with the newly promoted primary.
6. Failing over to a replica node is generally faster than creating and provisioning a new primary node. This means your application can resume writing to your primary node sooner than if Multi-AZ were not enabled.

if Multi-AZ is enabled, the downtime is minimized. The role of primary node will automatically fail over to one of the read replicas. 

Connect to a cluster

Connecting to a cluster mode disabled unencrypted-cluster

redis-cli -h cluster-endpoint -c -p port number

Connecting to an Encryption/Authentication enabled cluster

By default, redis-cli uses an unencrypted TCP connection when connecting to Redis. The option BUILD_TLS=yes enables SSL/TLS

You can use the option --tls with redis-cli to connect to both cluster mode enabled and disabled encrypted clusters. If a cluster has an AUTH token set, then you can use the option -a to provide an AUTH password.

The following example connects to an encryption and authentication enabled cluster:

src/redis-cli -h cluster-endpoint --tls -a your-password -p port number

The following example connects to a cluster that has only encryption enabled:

src/redis-cli -h cluster-endpoint --tls -a your-password -p port number

Redis-cli alternative
make a connection to the cluster for a short test but without going through the redis-cli compilation, you can use telnet or openssl

Doesn't have encryption

telnet cluster-endpoint port number

If the cluster has a password set, first connect to the cluster. 

openssl s_client -connect cluster-endpoint:port number Auth your-password

Create resource as code Cloudformation

Prerequisites

  SubnetGroup:
    Type: AWS::ElastiCache::SubnetGroup
    Properties:
      CacheSubnetGroupName: !Ref ServiceNameDatabase
      Description: None
      SubnetIds:
        - subnet-xxxxxxxx
        - subnet-xxxxxxxx
      Tags:
        - Key: Name
          Value: !Join ['-', [!Ref ServiceNameDatabase]  ]

  ParameterGroupClusterModeDisable:
    Type: AWS::ElastiCache::ParameterGroup
    Properties:
      CacheParameterGroupFamily: redis6.x
      Description: None
      Tags:
        - Key: Name
          Value: !Join ['-', [!Ref ServiceNameDatabase]  ]

  ParameterGroupClusterModeEnable:
    Type: AWS::ElastiCache::ParameterGroup
    Properties:
      CacheParameterGroupFamily: redis6.x
      Description: None
      Properties:
        cluster-enabled: 'yes'
      Tags:
        - Key: Name
          Value: !Join ['-', [!Ref ServiceNameDatabase]  ]

Cluster single node, cluster mode disabled

CacheClusterSingleNode:
  Type: AWS::ElastiCache::CacheCluster
  Properties:
    CacheNodeType: cache.t2.micro
    CacheParameterGroupName: !Ref ParameterGroup
    CacheSubnetGroupName: !Ref SubnetGroup
    ClusterName: !Join ['-', [!Ref ServiceNameDatabase, 'single-node']]
    Engine: redis
    EngineVersion: 6.2
    NumCacheNodes: 1
    Port: 6379
    Tags:
      - Key: Name
        Value: !Join ['-', [!Ref ServiceNameDatabase, 'single-node']]
    VpcSecurityGroupIds:
      - sg-xxxxxxxxxxxxxxx

Cluster with replication group, cluster mode disabled

CacheClusterReplicaGroupClusterModeDisable:
  Type: AWS::ElastiCache::ReplicationGroup
  Properties:
    AtRestEncryptionEnabled: true
    AutomaticFailoverEnabled: true
    CacheNodeType: cache.t2.micro
    CacheParameterGroupName: !Ref ParameterGroup
    CacheSubnetGroupName: !Ref SubnetGroup
    Engine: redis
    EngineVersion: 6.2
    MultiAZEnabled: true
    Port: 6379
    NumCacheClusters: 2       # NumCacheClusters is the number of nodes in a shard
    ReplicationGroupDescription: ReplicationGroupDescription
    # ReplicationGroupId: !Join ['-', [!Ref ServiceNameDatabase, 'replication-group-mode-disable']]
    ReplicationGroupId: !Join ['-', [!Ref ServiceNameDatabase, 'replication-group']]
    SecurityGroupIds:
      - sg-xxxxxxxxxxx
    Tags:
      - Key: Name
        Value: !Join ['-', [!Ref ServiceNameDatabase, 'replication-group']]
    TransitEncryptionEnabled: true

Cluster with replication group, cluster mode enabled 

CacheClusterReplicaGroupClusterModeEnable:
  Type: AWS::ElastiCache::ReplicationGroup
  Properties:
    AtRestEncryptionEnabled: true
    AutomaticFailoverEnabled: true
    CacheNodeType: cache.t2.micro
    CacheParameterGroupName: !Ref ParameterGroupClusterModeEnable
    CacheSubnetGroupName: !Ref SubnetGroup
    Engine: redis
    EngineVersion: 6.2
    MultiAZEnabled: true
    NumNodeGroups: 2 # Num nodes in a NodeGroup(shard)
    ReplicasPerNodeGroup: 2 # Num Replicas of a NodeGroup(shard)
    ReplicationGroupDescription: ReplicationGroupDescription
    ReplicationGroupId: !Join ['-', [!Ref ServiceNameDatabase, 'rg-mode-enable']]
    SecurityGroupIds:
      - sg-xxxxxxxx
    Tags:
      - Key: Name
        Value: !Join ['-', [!Ref ServiceNameDatabase, 'replication-group']]
    TransitEncryptionEnabled: true

Basic Admin Commands to handle the key-values and monitor the cluster

Go to the interactive console

redis-cli -h $REDIS_HOST -p $REDIS_PORT

-n set the database (from 0 to 16)

Info

The INFO command returns information and statistics about the server  in a format that is simple to pa redis-cli -h $REDIS_HOST -p $REDIS_PORT info

Stats

--stat             Print rolling stats about server: mem, clients, ...

redis-cli -h $REDIS_HOST -p $REDIS_PORT --stat -i 60 ------- data ------ --------------------- load -------------------- - child - keys       mem      clients blocked requests            connections 5          4.60M    4       0       249831572 (+0)      498921 5          4.60M    4       0       249831580 (+8)      498921

Monitor

MONITOR is a debugging command that streams back every command processed by the Redis server. It can help in understanding what is happening to the database. 

redis-cli -h $REDIS_HOST -p $REDIS_PORT monitor OK 1637594601.002083 [0 127.0.0.1:36308] "ping" 1637594601.002107 [0 127.0.0.1:36328] "ping" 1637594601.002252 [0 127.0.0.1:36308] "set" "ElastiCacheMasterReplicationTimestamp" "2021-11-22T15:23:21.001Z" 1637594601.002286 [0 127.0.0.1:36328] "info" "default"

Client List

The CLIENT LIST command returns information and statistics 
about the client connections server in a mostly human readable format.

redis-cli -h $REDIS_HOST -p $REDIS_PORT client list id=4xxxxx addr=xx.xx.x.xxx:xxxx fd=8 name= age=5727026 idle=0 flags=S db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=32768 obl=0 oll=0 omem=0 events=r cmd=replconf

References

• Getting started
• Fault Tolerance & MultiAZ
• Auto Failover
• Connect to a cluster
• Redis Terminology
• CFN Create cluster
• CFN Create replication group
• CFN Parameter group