Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 163 discussion

It seems to configure in-transit encryption in both new cluster and existing cluster, but updating is supported on Redis version 7 and later. So I will choose option A. https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#in-transit-encryption-constraints

A or B? I didn't read any comparison between these 2 options... For sure we need an auth token. Both, using SSM Parameter Store or Secrets Manager will work. Both, create a new cluster or update the current one will work. I will choose B because this approach avoids the need to set up a new cluster, potentially reducing effort and costs associated with migration or duplication of resources...

Option B

Option B

B, per redis docs. EC encr in transit is a config option

b-b-b-b-b-b-b Creating an AUTH token provides a form of authentication for accessing the ElastiCache cluster. Storing the AUTH token in AWS Secrets Manager ensures secure and centralized management of the token. Configuring the existing ElastiCache cluster to use the AUTH token enables authentication for accessing the cache. Enabling encryption in transit ensures that data is encrypted when it is transferred between the client and the ElastiCache cluster. Updating the application to retrieve the AUTH token from Secrets Manager and use it for authentication ensures that only authorized users can access the cache.

Create an AUTH token. Store the token in AWS Secrets Manager.

Redis CLI has AUTH command as a feature to SET/ROTATE strategies https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth.html

B seems right. To enable authentication on an existing Redis server, call the ModifyReplicationGroup API operation. Call ModifyReplicationGroup with the --auth-token parameter as the new token and the --auth-token-update-strategy with the value ROTATE. After the modification is complete, the cluster supports the AUTH token specified in the auth-token parameter in addition to supporting connecting without authentication. Enabling authentication is only supported on Redis servers with encryption in transit (TLS) enabled. https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth.html

As per https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html

You have to create a new cluster, otherwise the the cluster supports the AUTH token specified and supports connecting without authentication.

Previously, you needed to set up authentication for ElastiCache for Redis clusters using Redis user passwords or store the password in AWS Secrets Manager or on a third-party secrets management tool. However, in large organizations that host many applications, passwords can often become out of sync when it comes time to rotate the password. IAM authentication provides a streamlined security posture by allowing access management from a centralized service. With IAM authentication, ElastiCache users can use their IAM identities when connecting to their Redis clusters

https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html