# Azure Cache for Redis

> zop.dev provisions azurerm_redis_cache with 2 companions: a Key Vault secret holding the access key and a Kubernetes ExternalName alias. Terraform defaults to the Basic SKU while the application default is Standard C1, and Basic carries no replica and no SLA. The SKU meter runs continuously across 30 cataloged sizes.

Source: https://zop.dev/integrations/provision/azure/azure-cache-for-redis
Updated: 2026-08-19

---

Azure Cache for Redis is Microsoft's managed Redis service. zop.dev provisions the cache with its credentials stored in Key Vault and an in-cluster alias for applications.

## Redis cache, a Key Vault secret, and an alias

azurerm_redis_cache, a Key Vault secret for the access key, and a Kubernetes ExternalName service.

## SKU, capacity, family, and the non-SSL port

```text
sku_name default Basic (app default Standard C1); redis_cache_capacity 1; redis_cache_family C; non-SSL port flag (enabled in app defaults); 30 SKUs cataloged (Basic/Standard C0-C6, Premium P1-P5, Enterprise E1-E400, Flash F300-F1500).
```

## Basic in Terraform, Standard C1 in the API

Terraform default SKU (Basic) differs from the backend-api application default (Standard C1).

## Two defaults that disagree

The Terraform module defaults to the Basic SKU; the application-level default is Standard C1.
Which one you got depends on which path provisioned the cache, and the difference is not
cosmetic. Basic is a single node with no replication and no SLA, while Standard adds a replica
and the availability guarantee. Before reasoning about a cache's resilience, check which
default actually applied.

## A cache that restarts empty

On Basic, there is no replica to fail over to: maintenance events and node failures come back
with an empty cache. That is fine for a true cache, where the application repopulates from the
source of truth, and quietly catastrophic for anything using Redis as a session store or
queue. The moment Redis holds state you cannot recompute, Standard is the floor, and the
capacity/family settings (`redis_cache_capacity` 1, family C by default) size what you get.

## The non-SSL port flag

App defaults enable the non-SSL port: plaintext Redis on 6379. Inside a private network that
is a pragmatic compatibility choice for clients without TLS support, but it means credentials
and cached data cross the network unencrypted. For anything production-facing, disabling the
non-SSL port and letting clients speak TLS is the cheap hardening step this default leaves on
the table.

## Tier moves go up, not down

Scaling has a direction. Within and between Basic and Standard you can move up sizes (the
catalog spans C0 through C6, Premium P1 to P5, Enterprise E1 to E400 and Flash F300 to F1500),
and Standard can move to Premium, but downgrades across tiers are not supported, and
Enterprise is a separate track entirely. The SKU bills per hour regardless of traffic, so
oversizing "to be safe" is a permanent-feeling cost decision that only a migration walks back.