Redis Cache should allow access only via SSL

What does the recommendation "Redis Cache should allow access only via SSL" check?

Flags any Azure Cache for Redis instance where the non-TLS port (6379) is still open, meaning clients can connect in plaintext. The signal is the 'enableNonSslPort' property being set to true on the cache resource, and the rule applies across Basic, Standard and Premium tiers. It checks only whether the unencrypted port is reachable; it does not assess the negotiated 'minimumTlsVersion', the cipher suites in use, whether the cache sits behind a private endpoint, or whether your client actually chooses the TLS endpoint when both ports are open. A cache can therefore pass this control and still accept a weak TLS version, so treat closing the plaintext port as the floor rather than the whole story.

Why does "Redis Cache should allow access only via SSL" matter?

Redis carries session tokens, cached credentials and application data, and the plaintext port sends all of it, including the AUTH access key, across the wire unencrypted. Anyone able to observe traffic on a shared network path or a compromised host can capture that key, then read or overwrite the entire cache and impersonate users whose sessions live there. Because the access key authenticates every command, one captured connection is effectively a full breach of the cache. Closing the non-TLS port forces every client onto an encrypted channel and removes the option to leak the key in transit.

How do I fix "Redis Cache should allow access only via SSL"?

1. Set 'enableNonSslPort' to false on the cache so only the TLS port (6380) accepts connections. In the portal this is the 'Non-TLS port' toggle under Advanced settings; via CLI run 'az redis update --name <cache> --resource-group <rg> --set enableNonSslPort=false'.
2. Set 'minimumTlsVersion' to '1.2' on the same resource before closing the plaintext port, then confirm every client library is pointed at the 6380 endpoint with TLS enabled, so the cutover does not drop live connections.
3. Bake the safe defaults into your Bicep or Terraform module: 'enableNonSslPort: false' and 'minimumTlsVersion: '1.2'' on the Microsoft.Cache/Redis resource, so newly provisioned caches are encrypted-only without anyone having to remember the toggle.

# Close the highest-impact plaintext doors first: the Redis non-SSL port,
# then HTTPS-only + a modern TLS floor on every web app.

# Redis: disable the non-SSL port 6379 and require TLS 1.2 (clients use 6380).
for cache in $(az redis list --query "[?enableNonSslPort].name" -o tsv); do
  rg=$(az redis list --query "[?name=='$cache'].resourceGroup" -o tsv)
  az redis update --name "$cache" --resource-group "$rg" \
    --set enableNonSslPort=false minimumTlsVersion=1.2
  echo "$cache: non-SSL port disabled, min TLS 1.2"
done

# Web apps: enforce HTTPS only and raise the TLS floor.
for app in $(az webapp list --query "[?httpsOnly==\`false\`].name" -o tsv); do
  rg=$(az webapp list --query "[?name=='$app'].resourceGroup" -o tsv)
  az webapp update --name "$app" --resource-group "$rg" --https-only true
  az webapp config set --name "$app" --resource-group "$rg" --min-tls-version 1.2
  echo "$app: HTTPS only, min TLS 1.2"
done

# Functions follow the same pattern with az functionapp update --set httpsOnly=true.

# Ratchet it shut: assign the built-in deny policy for web apps over HTTPS only.
az policy assignment create \
  --name require-https-webapp \
  --policy a4af4a39-4135-47fb-b175-47fbdf85311d \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"