Service Protection

You need:

• A running Redis instance on an AWS ElastiCache cluster for Valkey 7.2 or later or ElastiCache for Redis OSS version 7.0 or later
• The ElastiCache user needs to set “Authentication mode” to “IAM”
• The following policy assigned to the IAM user/IAM role that is used to connect to the ElastiCache:

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "elasticache:Connect"
              ],
              "Resource": [
                  "arn:aws:elasticache:ARN_OF_THE_ELASTICACHE",
                  "arn:aws:elasticache:ARN_OF_THE_ELASTICACHE_USER"
              ]
          }
      ]
  }
  

  Copied!

To configure cloud authentication with Redis, add the following parameters to your plugin configuration:

config:
  storage: redis
  storage_config:
    redis:
      cluster_nodes:
      - ip: $CLUSTER_ADDRESS
        port: 6379
      username: $CLUSTER_USERNAME
      port: 6379
      cloud_authentication:
        auth_provider: aws
        aws_cache_name: $AWS_CACHE_NAME
        aws_is_serverless: false
        aws_region: $AWS_REGION
        aws_access_key_id: $AWS_ACCESS_KEY_ID
        aws_secret_access_key: $AWS_ACCESS_SECRET_KEY

Replace the following with your actual values:

• $CLUSTER_ADDRESS: The ElastiCache cluster address.
• $CLUSTER_USERNAME: The ElastiCache username with IAM Auth mode configured.
• $AWS_CACHE_NAME: Name of your AWS ElastiCache cluster.
• $AWS_REGION: Your AWS ElastiCache cluster region.
• $AWS_ACCESS_KEY_ID: (Optional) Your AWS access key ID.
• $AWS_ACCESS_SECRET_KEY: (Optional) Your AWS secret access key.

You need:

• A running Redis instance on an Azure Managed Redis instance with Entra authentication configured
• Add the user/service principal/identity to the “Microsoft Entra Authentication Redis user” list for the Azure Managed Redis instance

To configure cloud authentication with Redis, add the following parameters to your plugin configuration:

config:
  storage: redis
  storage_config:
    redis:
      host: $INSTANCE_ADDRESS
      username: $INSTANCE_USERNAME
      port: 6379
      cloud_authentication:
        auth_provider: azure
        azure_client_id: $AZURE_CLIENT_ID
        azure_client_secret: $AZURE_CLIENT_SECRET
        azure_tenant_id: $AZURE_TENANT_ID

Replace the following with your actual values:

• $INSTANCE_ADDRESS: The Azure Managed Redis instance address.
• $INSTANCE_USERNAME: The object (principal) ID of the Principal/Identity with essential access.
• $AZURE_CLIENT_ID: The client ID of the Principal/Identity.
• $AZURE_CLIENT_SECRET: (Optional) The client secret of the Principal/Identity.
• $AZURE_TENANT_ID: (Optional) The tenant ID of the Principal/Identity.

You need:

• A running Redis instance on an Azure Managed Redis cluster with Entra authentication configured
• Add the user/service principal/identity to the “Microsoft Entra Authentication Redis user” list for the Azure Managed Redis instance

To configure cloud authentication with Redis, add the following parameters to your plugin configuration:

config:
  storage: redis
  storage_config:
    redis:
      cluster_nodes:
      - ip: $CLUSTER_ADDRESS
        port: 6379
      username: $CLUSTER_USERNAME
      port: 6379
      cloud_authentication:
        auth_provider: azure
        azure_client_id: $AZURE_CLIENT_ID
        azure_client_secret: $AZURE_CLIENT_SECRET
        azure_tenant_id: $AZURE_TENANT_ID

Replace the following with your actual values:

• $CLUSTER_ADDRESS: The Azure Managed Redis cluster address.
• $CLUSTER_USERNAME: The object (principal) ID of the Principal/Identity with essential access.
• $AZURE_CLIENT_ID: The client ID of the Principal/Identity.
• $AZURE_CLIENT_SECRET: (Optional) The client secret of the Principal/Identity.
• $AZURE_TENANT_ID: (Optional) The tenant ID of the Principal/Identity.

You need:

• A running Redis instance on an Google Cloud Memorystore instance
• Assign the principal to the corresponding role:
  • Cloud Memorystore Redis DB Connection User(roles/redis.dbConnectionUser) for Memorystore for Redis Cluster
  • Memorystore DB Connector User (roles/memorystore.dbConnectionUser) for Memorystore for Valkey

To configure cloud authentication with Redis, add the following parameters to your plugin configuration:

config:
  storage: redis
  storage_config:
    redis:
      host: $INSTANCE_ADDRESS
      port: 6379
      cloud_authentication:
        auth_provider: gcp
        gcp_service_account_json: $GCP_SERVICE_ACCOUNT

Replace the following with your actual values:

• $INSTANCE_ADDRESS: The Memorystore instance address.
• $GCP_SERVICE_ACCOUNT: (Optional) The GCP service account JSON.

You need:

• A running Redis instance on an Google Cloud Memorystore cluster
• Assign the principal to the corresponding role:
  • Cloud Memorystore Redis DB Connection User(roles/redis.dbConnectionUser) for Memorystore for Redis Cluster
  • Memorystore DB Connector User (roles/memorystore.dbConnectionUser) for Memorystore for Valkey

To configure cloud authentication with Redis, add the following parameters to your plugin configuration:

config:
  storage: redis
  storage_config:
    redis:
      cluster_nodes:
      - ip: $CLUSTER_ADDRESS
        port: 6379
      port: 6379
      cloud_authentication:
        auth_provider: gcp
        gcp_service_account_json: $GCP_SERVICE_ACCOUNT

Replace the following with your actual values:

• $CLUSTER_ADDRESS: The Memorystore cluster address.
• $GCP_SERVICE_ACCOUNT: The GCP service account JSON.