[Bug]: aws_elasticache_cluster , redis oss does not support transit_encryption_enabled

Documentation Link(s)

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_cluster#transit_encryption_enabled-1

Description

As per the terraform docs, aws_elasticache_cluster supports transit_encryption_enabled optional parameter:

transit_encryption_enabled - (Optional) Enable encryption in-transit. Supported with Memcached versions 1.6.12 and later, Redis OSS versions 3.2.6, 4.0.10 and later, running in a VPC. See the ElastiCache in-transit encryption documentation for more details.

---

If we try to create aws_elasticache_cluster with transit_encryption_enabled = true then it fails, AWS API returns error : InvalidParameterCombination: Encryption feature is not supported for engine REDIS.

Error:

% terraform apply plan
aws_vpc.test: Creating...
aws_vpc.test: Creation complete after 1s [id=vpc-0cf3da48569000000]
aws_subnet.test: Creating...
aws_subnet.test: Creation complete after 1s [id=subnet-0569d807834000000]
aws_elasticache_subnet_group.test: Creating...
aws_elasticache_subnet_group.test: Creation complete after 1s [id=test-subnet-group]
aws_elasticache_cluster.test: Creating...
╷
│ Error: creating ElastiCache Cache Cluster (test-cluster): operation error ElastiCache: CreateCacheCluster, https response error StatusCode: 400, RequestID: cd9999c7-d012-4581-b352-37aaaaaa2539, InvalidParameterCombination: Encryption feature is not supported for engine REDIS.
│
│   with aws_elasticache_cluster.test,
│   on main.tf line 67, in resource "aws_elasticache_cluster" "test":
│   67: resource "aws_elasticache_cluster" "test" {
│
╵

Sample Terraform Configuration:

locals {
prefix                         = "some-prefix"
engine                         = "redis"
}

resource "aws_vpc" "test" {
  cidr_block = "10.0.0.0/16"

  tags = {
    Name = "${local.prefix}-vpc"
  }
}

resource "aws_subnet" "test" {
  vpc_id     = aws_vpc.test.id
  cidr_block = "10.0.1.0/24"

  tags = {
    Name = "${local.prefix}-subnet"
  }
}

resource "aws_elasticache_subnet_group" "test" {
  name       = "${local.prefix}-subnet-group"
  subnet_ids = [aws_subnet.test.id]
}
resource "aws_elasticache_cluster" "test" {
  cluster_id               = "${local.prefix}-cluster"
  engine                   = local.engine
  engine_version           = "7.1"
  node_type                = "cache.t3.micro"
  num_cache_nodes          = 1
  port                     = 6379
  subnet_group_name        = aws_elasticache_subnet_group.test.name
  transit_encryption_enabled = true
}

• aws_elasticache_cluster resource uses the AWS CreateCacheCluster API under the hood.
• Although AWS docs for CreateCacheCluster mentions optional TransitEncryptionEnabled parameter, it fails if we provider one.

References

AWS points out that in-transit encryption is supported in replication group for redis/valkey.

Would you like to implement a fix?

Yes