elasticache-repl-grp-encrypted-at-rest

Checks if Amazon ElastiCache replication groups have encryption-at-rest enabled. The rule is NON_COMPLIANT for an ElastiCache replication group if 'AtRestEncryptionEnabled' is disabled or if the KMS key ARN does not match the approvedKMSKeyArns parameter.

Identifier: ELASTICACHE_REPL_GRP_ENCRYPTED_AT_REST

Resource Types: AWS::ElastiCache::ReplicationGroup

Trigger type: Periodic

AWS Region: All supported AWS regions except Middle East (UAE), Asia Pacific (Melbourne), AWS GovCloud (US-East), AWS GovCloud (US-West), Israel (Tel Aviv) Region

Parameters:

approvedKMSKeyIds (Optional)

Type: CSV

Comma-separated list of KMS Key IDs that are approved for ElastiCache usage.

AWS CloudFormation template

To create AWS Config managed rules with AWS CloudFormation templates, see Creating AWS Config Managed Rules With AWS CloudFormation Templates.