ElastiCache.1: A Redis cluster has no automatic backups

What does AWS Security Hub ElastiCache.1 check?

ElastiCache.1 fails when an ElastiCache (Redis OSS or Valkey) cluster or replication group has a `SnapshotRetentionLimit` below the required threshold (the `snapshotRetentionPeriod` parameter, default 1 day, allowed 1-35), most commonly a limit of 0, meaning automatic backups are off. Memcached has no backups and is out of scope.

Why does ElastiCache.1 matter?

Caches described as "ephemeral" routinely become the only live record of state: idempotency keys, session data, in-flight tokens. With no backups, a node replacement during a routine engine upgrade can bring the cluster back empty, and there is nothing to restore from. Whatever the cache was quietly the source of truth for is simply gone.

How do I fix ElastiCache.1?

1. List clusters and replication groups and check `SnapshotRetentionLimit` to find any below the threshold (commonly 0).
2. Modify each cluster or replication group to set a retention window (for example 7 days), which can be done in place.
3. Set a backup window that does not collide with the maintenance window; note very small node types cannot snapshot.
4. Add a Config rule so new clusters always launch with a non-zero retention limit.

# Set a 7-day backup floor on production databases below it (skip read replicas).
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?ReadReplicaSourceDBInstanceIdentifier==`null` && BackupRetentionPeriod<`7`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --backup-retention-period 7 --no-apply-immediately
done

# Turn on DynamoDB point-in-time recovery (instant, no downtime).
aws dynamodb update-continuous-backups --table-name prod-orders \
  --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true

# Stop any snapshot in the account from being shared publicly, ever.
aws ec2 enable-snapshot-block-public-access --state block-all-sharing