iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

ElastiCache

By · Reviewed & last updated · Part of AWS Tutorial

ElastiCache is AWSs managed Redis (and Memcached). It gives you a Redis cluster with TLS, IAM auth, automated backups, and one-click failover without you running EC2. Pick it for caches, rate limiters, leaderboards, sessions, and any pattern where a small in-memory hop saves big DB load.

Provision, secure, connect, and operate ElastiCache

EXAMPLE
# 1) Pick the engine + topology
# Redis OSS:           single-node OR cluster mode disabled (replica failover only)
# Redis Cluster mode:  sharded across many nodes (hash slots)
# Memcached:           multi-node, no replication, simpler

# For most apps: Redis OSS in cluster mode disabled, 2 replicas, 1 primary.
# Cluster mode only when you exceed ~500GB or need write throughput beyond
# what a single primary can handle.

# 2) Create a Subnet Group (required) + Security Group (allow app SG on 6379)
aws elasticache create-cache-subnet-group \
  --cache-subnet-group-name shop-redis-subnets \
  --subnet-ids subnet-aaa subnet-bbb subnet-ccc \
  --cache-subnet-group-description 'private subnets for redis'

sg=$(aws ec2 create-security-group --group-name redis-clients \
        --description '6379 from app tier' --vpc-id vpc-0abc1234 \
        --query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $sg \
  --protocol tcp --port 6379 --source-group sg-app-tier

# 3) Create the cluster
aws elasticache create-replication-group \
  --replication-group-id shop-redis \
  --replication-group-description 'shop cache' \
  --engine redis \
  --engine-version 7.1 \
  --cache-node-type cache.r7g.large \
  --num-cache-clusters 3 \
  --automatic-failover-enabled \
  --multi-az-enabled \
  --cache-subnet-group-name shop-redis-subnets \
  --security-group-ids $sg \
  --transit-encryption-enabled \
  --at-rest-encryption-enabled \
  --auth-token "$(openssl rand -base64 32)" \
  --snapshot-retention-limit 7 \
  --snapshot-window '13:30-14:30' \
  --preferred-maintenance-window 'mon:14:30-15:30' \
  --tags Key=project,Value=shop Key=env,Value=prod

# 4) Connect — primary endpoint is the WRITE endpoint
aws elasticache describe-replication-groups \
  --replication-group-id shop-redis \
  --query 'ReplicationGroups[0].NodeGroups[0].PrimaryEndpoint'

# 5) Node.js client (ioredis) with TLS + AUTH
# const Redis = require('ioredis');
# const r = new Redis({
#   host:      'shop-redis.xxx.ng.0001.apse2.cache.amazonaws.com',
#   port:      6379,
#   tls:       {},
#   password:  process.env.REDIS_AUTH_TOKEN,
#   maxRetriesPerRequest: 3,
#   enableReadyCheck: true,
# });

# 6) Read scaling — point reads at READER endpoint
# AWS publishes a 'Reader Endpoint' that load-balances across replicas.
# const reads = new Redis({ host: '<reader-endpoint>', port: 6379, tls: {}, password: ... });

# 7) Auto-failover testing
# Manually trigger a primary failover; primary endpoint stays the same.
aws elasticache test-failover --replication-group-id shop-redis --node-group-id 0001

# 8) Monitor what matters
# CloudWatch metrics:
# - EngineCPUUtilization > 75% sustained -> scale node type
# - DatabaseMemoryUsagePercentage > 80% -> grow node OR check eviction policy
# - CacheHitRate < 90% -> tune TTLs or cache strategy
# - ReplicationLag > 1s -> investigate

# 9) Tune maxmemory-policy via Parameter Group
aws elasticache create-cache-parameter-group \
  --cache-parameter-group-name shop-redis-params \
  --cache-parameter-group-family redis7 \
  --description 'allkeys-lru for cache workload'
aws elasticache modify-cache-parameter-group --cache-parameter-group-name shop-redis-params \
  --parameter-name-values 'ParameterName=maxmemory-policy,ParameterValue=allkeys-lru'

# Apply to the replication group (immediate)
aws elasticache modify-replication-group --replication-group-id shop-redis \
  --cache-parameter-group-name shop-redis-params --apply-immediately

# 10) When ElastiCache is the WRONG choice
# - Tiny app, no traffic         -> a small Redis container costs cents and serves fine
# - Workload that fits in one Postgres instance with materialised views
# - Strong consistency required across regions (ElastiCache replication is async)
# - Pub/Sub at hundreds of MB/s (Redis Streams + Kinesis is cheaper)

Why it matters

Turn on encryption at rest, encryption in transit, and a TLS-aware client connection from day one. The cost is one config flag each; the value is "we never ran ElastiCache on plaintext on hostile networks." Auth tokens + TLS turn the cache from a backdoor into an internal service even your audit team is happy with.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# Managed Redis or Memcached.
Try it Yourself »

Discussion

Loading…