Prerequisites Granting ElastiCache permission to publish to your Amazon SNS topic Adding an Amazon SNS topic Enabling and disabling Amazon SNS notifications Security best practices for Amazon SNS topic policies Verifying that notifications are working Troubleshooting Amazon SNS notifications

Managing ElastiCache Amazon SNS notifications

You can configure ElastiCache to send notifications for important cluster events using Amazon Simple Notification Service (Amazon SNS). In these examples, you will configure a cluster with the Amazon Resource Name (ARN) of an Amazon SNS topic to receive notifications.

Note

This topic assumes that you've signed up for Amazon SNS and have set up and subscribed to an Amazon SNS topic. For information on how to do this, see the Amazon Simple Notification Service Developer Guide.
By default, the API modify-replication-group affects all groups in a Region and not just the current specified group. If you want to configure one specific group in a Region differently than the other groups, you can use the --notification-topic-arn option to create a separate topic for that group.

Encrypted Amazon SNS topics are not supported

ElastiCache cannot publish to an encrypted Amazon SNS topic, whether the topic uses the Amazon managed key for Amazon SNS or a customer managed key. You can attach an encrypted topic to a cluster, and its status shows as active. When ElastiCache sends the first notification, it sets the topic status to inactive and does not emit an event. Use an unencrypted topic.

Prerequisites

Before you configure Amazon SNS notifications for ElastiCache, verify the following requirements:

The Amazon SNS topic must be in the same Amazon Region as your ElastiCache cluster.
The Amazon SNS topic must be owned by the same Amazon account as your ElastiCache cluster.
The Amazon SNS topic must be unencrypted. ElastiCache cannot publish to a topic that is encrypted with the Amazon managed key for Amazon SNS or with a customer managed key.
You must have permissions to modify the Amazon SNS topic access policy (sns:SetTopicAttributes or equivalent).

Granting ElastiCache permission to publish to your Amazon SNS topic

To receive event notifications, you must grant ElastiCache permission to publish messages to your Amazon SNS topic. You do this by adding a resource-based policy to the Amazon SNS topic that allows the elasticache.amazonaws.com service principal to publish messages.

The following policy grants ElastiCache the required permission:


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowElastiCachePublish",
      "Effect": "Allow",
      "Principal": {
        "Service": "elasticache.amazonaws.com"
      },
      "Action": "sns:Publish",
      "Resource": "arn:aws:sns:region:account-id:topic-name",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "account-id"
        }
      }
    }
  ]
}

The following table describes the policy components.

Component	Value	Description
Principal	`elasticache.amazonaws.com`	The ElastiCache service principal
Action	`sns:Publish`	The minimum required permission
Resource	Topic ARN	The ARN of your specific Amazon SNS topic
Condition: `aws:SourceAccount`	Your Amazon account ID	Restricts access to requests originating from your specific Amazon account

The condition can use either aws:SourceAccount or aws:SourceOwner. The default access policy that Amazon SNS creates for a new topic also works without changes.

Granting permission (Console)

To grant ElastiCache permission to publish to your Amazon SNS topic (Console)

Open the Amazon Simple Notification Service console at https://console.aws.amazon.com/sns/.
In the navigation pane, choose Topics.
Select your topic and choose Edit.
Expand the Access policy section.
In the JSON editor, add the preceding policy statement.
Choose Save changes.

Granting permission (Amazon CLI)

Save the access policy to a file named sns-policy.json, then run the following command:

For Linux, OS X, or Unix:


aws sns set-topic-attributes \
    --topic-arn arn:aws:sns:region:account-id:topic-name \
    --attribute-name Policy \
    --attribute-value file://sns-policy.json \
    --region region

For Windows:


aws sns set-topic-attributes ^
    --topic-arn arn:aws:sns:region:account-id:topic-name ^
    --attribute-name Policy ^
    --attribute-value file://sns-policy.json ^
    --region region

To verify the policy was applied correctly, run the following command:

For Linux, OS X, or Unix:


aws sns get-topic-attributes \
    --topic-arn arn:aws:sns:region:account-id:topic-name \
    --query 'Attributes.Policy' \
    --output text \
    --region region

For Windows:


aws sns get-topic-attributes ^
    --topic-arn arn:aws:sns:region:account-id:topic-name ^
    --query 'Attributes.Policy' ^
    --output text ^
    --region region

Adding an Amazon SNS topic

The following sections show you how to add an Amazon SNS topic using the Amazon Console, the Amazon CLI, or the ElastiCache API.

Adding an Amazon SNS topic (Console)

The following procedure shows you how to add an Amazon SNS topic for a cluster. When using Valkey or Redis OSS to add an Amazon SNS topic for a replication group in step 2, instead of choosing a cluster, choose a replication group. Then follow the same remaining steps.

Note

This process can also be used to modify the Amazon SNS topic.

To add or modify an Amazon SNS topic for a cluster (Console)

Sign in to the Amazon Web Services Management Console and open the ElastiCache console at https://console.amazonaws.cn/elasticache/.
In Clusters, choose the cluster for which you want to add or modify an Amazon SNS topic ARN.
Choose Modify.
In Modify Cluster under Topic for SNS Notification, choose the SNS topic you want to add, or choose Manual ARN input and type the ARN of the Amazon SNS topic.
Choose Modify.

Adding an Amazon SNS topic (Amazon CLI)

To add or modify an Amazon SNS topic for a cluster, use the Amazon CLI command modify-cache-cluster.

The following code example adds an Amazon SNS topic arn to my-cluster.

For Linux, OS X, or Unix:


aws elasticache modify-cache-cluster \
    --cache-cluster-id my-cluster \
    --notification-topic-arn arn:aws:sns:us-west-2:123456789xxx:ElastiCacheNotifications

For Windows:


aws elasticache modify-cache-cluster ^
    --cache-cluster-id my-cluster ^
    --notification-topic-arn arn:aws:sns:us-west-2:123456789xx:ElastiCacheNotifications

For more information, see modify-cache-cluster.

Adding an Amazon SNS topic (ElastiCache API)

To add or modify an Amazon SNS topic for a cluster, call the ModifyCacheCluster action with the following parameters:

CacheClusterId=my-cluster
TopicArn=arn%3Aaws%3Asns%3Aus-west-2%3A565419523791%3AElastiCacheNotifications

Example


https://elasticache.amazon.com/
    ?Action=ModifyCacheCluster
    &ApplyImmediately=false
    &CacheClusterId=my-cluster
    &NotificationTopicArn=arn%3Aaws%3Asns%3Aus-west-2%3A565419523791%3AElastiCacheNotifications
    &Version=2014-12-01
    &SignatureVersion=4
    &SignatureMethod=HmacSHA256
    &Timestamp=20141201T220302Z
    &X-Amz-Algorithm=&AWS;4-HMAC-SHA256
    &X-Amz-Date=20141201T220302Z
    &X-Amz-SignedHeaders=Host
    &X-Amz-Expires=20141201T220302Z
    &X-Amz-Credential=<credential>
    &X-Amz-Signature=<signature>

For more information, see ModifyCacheCluster.

Enabling and disabling Amazon SNS notifications

You can turn notifications on or off for a cluster. The following procedures show you how to disable Amazon SNS notifications.

Enabling and disabling Amazon SNS notifications (Console)

To disable Amazon SNS notifications using the Amazon Web Services Management Console

Sign in to the Amazon Web Services Management Console and open the ElastiCache console at https://console.amazonaws.cn/elasticache/.
To see a list of your clusters running Memcached, in the navigation pane choose Memcached.

To see a list of your clusters running Valkey or Redis OSS, in the navigation pane choose Valkey or Redis OSS.
Choose the box to the left of the cluster you want to modify notification for.
Choose Modify.
In Modify Cluster under Topic for SNS Notification, choose Disable Notifications.
Choose Modify.

Enabling and disabling Amazon SNS notifications (Amazon CLI)

To disable Amazon SNS notifications, use the command modify-cache-cluster with the following parameters:

For Linux, OS X, or Unix:


aws elasticache modify-cache-cluster \
    --cache-cluster-id my-cluster \
    --notification-topic-status inactive

For Windows:


aws elasticache modify-cache-cluster ^
    --cache-cluster-id my-cluster ^
    --notification-topic-status inactive

Note

When the cluster belongs to a replication group, you must use the CLI command modify-replication-group to enable or disable SNS notifications.

Enabling and disabling Amazon SNS notifications (ElastiCache API)

To disable Amazon SNS notifications, call the ModifyCacheCluster action with the following parameters:

CacheClusterId=my-cluster
NotificationTopicStatus=inactive

This call returns output similar to the following:

Example


https://elasticache.us-west-2.amazonaws.com/
    ?Action=ModifyCacheCluster
    &ApplyImmediately=false
    &CacheClusterId=my-cluster
    &NotificationTopicStatus=inactive
    &Version=2014-12-01
    &SignatureVersion=4
    &SignatureMethod=HmacSHA256
    &Timestamp=20141201T220302Z
    &X-Amz-Algorithm=&AWS;4-HMAC-SHA256
    &X-Amz-Date=20141201T220302Z
    &X-Amz-SignedHeaders=Host
    &X-Amz-Expires=20141201T220302Z
    &X-Amz-Credential=<credential>
    &X-Amz-Signature=<signature>

Security best practices for Amazon SNS topic policies

To help secure your Amazon SNS topic policy, follow these best practices:

Always include the aws:SourceAccount condition key to prevent cross-account confused deputy attacks.
Use the elasticache.amazonaws.com service principal rather than individual Amazon account IDs.
Never use "Principal": {"AWS": "*"} without additional condition keys.
Grant only the minimum required permissions (sns:Publish only).
Regularly audit your Amazon SNS topic access policies.

Verifying that notifications are working

After configuring the Amazon SNS topic policy and adding the topic to your ElastiCache cluster, verify that notifications are working:

Trigger an ElastiCache event, such as a configuration change on your cluster.
Check your Amazon SNS subscription endpoint (email, Lambda function, or SQS queue) for the notification message.
In the Amazon SNS console, verify that the subscription status shows Confirmed.
To check the topic status, run describe-cache-clusters for each node and read TopicStatus in NotificationConfiguration. The describe-replication-groups command does not return it.

Troubleshooting Amazon SNS notifications

If you are not receiving Amazon SNS notifications from ElastiCache, check the following:

Topic encryption: If the topic status is inactive, check whether the topic is encrypted. ElastiCache sets an encrypted topic to inactive at the first notification. Use an unencrypted topic, and then turn notifications back on.
Region mismatch: Verify that the Amazon SNS topic is in the same Amazon Region as your ElastiCache cluster.
Account ownership: Verify that the Amazon SNS topic is owned by the same Amazon account as your ElastiCache cluster.
Incorrect account ID in condition: Check that the aws:SourceAccount value is your exact 12-digit Amazon account ID.
Topic ARN mismatch: Confirm that the Amazon SNS topic ARN in the policy matches exactly the ARN of the topic attached to your ElastiCache cluster.
Unconfirmed subscription: Verify that your Amazon SNS subscription is in Confirmed status.
Insufficient permissions: Confirm that you have sns:SetTopicAttributes permission to modify the topic's access policy.

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon SNS event monitoring

Viewing ElastiCache events