Connecting to Amazon ElastiCache (Redis OSS) with in-transit encryption using redis-cli
To access data from ElastiCache (Redis OSS) caches enabled with in-transit encryption, you use clients that work with Secure Socket Layer (SSL). You can also use redis-cli with TLS/SSL on Amazon Linux and Amazon Linux 2.
If your client does not support TLS, you can use the stunnel
command on your client host to create an SSL tunnel to the Redis OSS nodes.
Encrypted connection with Linux
To use redis-cli to connect to a Redis OSS cluster enabled with in-transit encryption on Amazon Linux 2023, Amazon Linux 2, or Amazon Linux, follow these steps.
Download and compile the redis-cli utility. This utility is included in the Redis OSS software distribution.
At the command prompt of your EC2 instance, type the appropriate commands for the version of Linux you are using.
Amazon Linux 2023
If using Amazon Linux 2023, enter this:
sudo yum install redis6 -y
Then type the following command, substituting the endpoint of your cluster and port for what is shown in this example.
redis-cli -h
Primary or Configuration Endpoint
--tls -p 6379For more information on finding the endpoint, see Find your Node Endpoints.
Amazon Linux 2
If using Amazon Linux 2, enter this:
sudo yum -y install openssl-devel gcc wget https://download.redis.io/releases/redis-7.2.5.tar.gz tar xvzf redis-7.2.5.tar.gz cd redis-7.2.5 make distclean make redis-cli BUILD_TLS=yes sudo install -m 755 src/redis-cli /usr/local/bin/
Amazon Linux
If using Amazon Linux, enter this:
sudo yum install gcc jemalloc-devel openssl-devel tcl tcl-devel clang wget wget http://download.redis.io/redis-7.2.5.tar.gz tar xvzf redis-7.2.5.tar.gz cd redis-7.2.5 make redis-cli CC=clang BUILD_TLS=yes sudo install -m 755 src/redis-cli /usr/local/bin/
On Amazon Linux, you may also need to run the following additional steps:
sudo yum install clang CC=clang make sudo make install
After you have downloaded and installed the redis-cli utility, it is recommended that you run the optional
make-test
command.-
To connect to a cluster with encryption and authentication enabled, enter this command:
redis-cli -h
Primary or Configuration Endpoint
--tls -a'your-password'
-p 6379Note
If you install redis6 on Amazon Linux 2023, you can now use the command
redis6-cli
instead ofredis-cli
:redis6-cli -h Primary or Configuration Endpoint --tls -p 6379
Encrypted connection with stunnel
To use redis-cli to connect to a Redis OSS cluster enabled with in-transit encryption using stunnel, follow these steps.
-
Use SSH to connect to your client and install
stunnel
.sudo yum install stunnel
-
Run the following command to create and edit file
'/etc/stunnel/redis-cli.conf'
simultaneously to add a ElastiCache (Redis OSS) cluster endpoint to one or more connection parameters, using the provided output below as template.vi /etc/stunnel/redis-cli.conf fips = no setuid = root setgid = root pid = /var/run/stunnel.pid debug = 7 delay = yes options = NO_SSLv2 options = NO_SSLv3 [redis-cli] client = yes accept = 127.0.0.1:6379 connect = primary.ssltest.wif01h.use1.cache.amazonaws.com:6379 [redis-cli-replica] client = yes accept = 127.0.0.1:6380 connect = ssltest-02.ssltest.wif01h.use1.cache.amazonaws.com:6379
In this example, the config file has two connections, the
redis-cli
and theredis-cli-replica
. The parameters are set as follows:-
client is set to yes to specify this stunnel instance is a client.
-
accept is set to the client IP. In this example, the primary is set to the Redis OSS default 127.0.0.1 on port 6379. The replica must call a different port and set to 6380. You can use ephemeral ports 1024–65535. For more information, see Ephemeral ports in the Amazon VPC User Guide.
-
connect is set to the Redis OSS server endpoint. For more information, see Finding connection endpoints in ElastiCache.
-
-
Start
stunnel
.sudo stunnel /etc/stunnel/redis-cli.conf
Use the
netstat
command to confirm that the tunnels started.sudo netstat -tulnp | grep -i stunnel tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 3189/stunnel tcp 0 0 127.0.0.1:6380 0.0.0.0:* LISTEN 3189/stunnel
-
Connect to the encrypted Redis OSS node using the local endpoint of the tunnel.
-
If no AUTH password was used during ElastiCache (Redis OSS) cluster creation, this example uses the redis-cli to connect to the ElastiCache (Redis OSS) server using complete path for redis-cli, on Amazon Linux:
/home/ec2-user/redis-7.2.5.tar.gz/src/redis-cli -h localhost -p 6379
If AUTH password was used during Redis OSS cluster creation, this example uses redis-cli to connect to the Redis OSS server using complete path for redis-cli, on Amazon Linux:
/home/ec2-user/redis-7.2.5.tar.gz/src/redis-cli -h localhost -p 6379 -a
my-secret-password
OR
Change directory to redis-7.2.5 and do the following:
If no AUTH password was used during ElastiCache (Redis OSS) cluster creation, this example uses the redis-cli to connect to the ElastiCache (Redis OSS) server using complete path for redis-cli, on Amazon Linux:
src/redis-cli -h localhost -p 6379
If AUTH password was used during Redis OSS cluster creation, this example uses redis-cli to connect to the Redis OSS server using complete path for redis-cli, on Amazon Linux:
src/redis-cli -h localhost -p 6379 -a
my-secret-password
This example uses Telnet to connect to the Redis OSS server.
telnet localhost 6379 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. auth MySecretPassword +OK get foo $3 bar
-
-
To stop and close the SSL tunnels,
pkill
the stunnel process.sudo pkill stunnel