# ElastiCache Redis

> zop.dev provisions an ElastiCache Redis cluster with its subnet group, parameter group and security group, wired into the VPC private tier with no public access path. Node type and replica count are the 2 settings that determine both resilience and monthly cost.

Source: https://zop.dev/integrations/provision/aws/elasticache-redis
Updated: 2026-08-19

---

Amazon ElastiCache provides managed Redis for low-latency caching and session storage. zop.dev provisions the replication group with networking and an in-cluster DNS alias so services reach the cache by a stable Kubernetes service name.

## A Redis replication group with an ExternalName alias

ElastiCache replication group (cluster mode on when num_node_groups > 1, otherwise single node group), subnet group, security group on port 6379, and a Kubernetes ExternalName service.

## cache.m5.large default and node group sizing

```text
node_type default cache.m5.large; replicas_per_node_group 1; num_node_groups 2; engine_version 6.2. Cluster mode adds multi-AZ, automatic failover, and at-rest encryption; 74 node types cataloged (m7g/m6g/m5/m4/t4g/t3/t2/r-series/c7gn).
```

## Standalone and replication-group deployment types

The provisioner API also supports standalone vs replication-group deployment types with a filterable 36-entry node-type catalog and 26 default regions.

## Replicas do two different jobs

A read replica in ElastiCache serves read traffic **and** acts as a failover target, and those
are different requirements that people conflate.

If you need failover, you need Multi-AZ with automatic failover enabled. A replica alone does
not promote itself. If you need read throughput, replicas help only if your client is configured
to use reader endpoints, which many are not by default.

Provisioning replicas for resilience and then pointing every client at the primary endpoint is
the common outcome: you pay for the replica and get neither benefit.

## Sizing is about memory, not CPU

Redis is single-threaded for command execution, so a larger node type mostly buys memory rather
than throughput. The right size is driven by working-set size plus overhead for replication
buffers and fragmentation, typically a meaningful margin above raw data size.

Undersizing produces evictions rather than errors, which is why a cache can be silently too
small for months. `Evictions` on CloudWatch is the metric that tells you.

## The private-subnet default

The cluster lands in the VPC's private tier with a security group scoped to it. There is no
public access path, which is correct: Redis has no meaningful authentication story for internet
exposure, and an internet-reachable Redis is one of the more reliably exploited misconfigurations.

## What it costs when idle

ElastiCache bills per node-hour regardless of traffic. A cluster nobody connects to costs the
same as a busy one, which is why the idle-cluster rule requires four separate signals before
recommending removal. The cost is real, but so is the risk of deleting a cache something is
about to need.