Description

Identifies AWS ElastiCache clusters defined in CloudFormation templates that do not have transit encryption enabled. When transit encryption is disabled, data transmitted between the cache nodes and client applications is not encrypted, potentially exposing sensitive information to unauthorized access during transmission.

Detection Strategy

• Examines CloudFormation resource definitions of type 'AWS::ElastiCache::CacheCluster'

• Checks if the TransitEncryptionEnabled property is either missing or set to false

• Reports a vulnerability when an ElastiCache cluster is configured without transit encryption, making data-in-transit vulnerable to interception

Vulnerable code example

Resources:
  MyRedisCache:
    Type: 'AWS::ElastiCache::CacheCluster'
    Properties:
      CacheNodeType: 'cache.t2.micro'
      Engine: 'redis'
      NumCacheNodes: '1'
      TransitEncryptionEnabled: false  # Vulnerable: Transit encryption disabled, data in transit not protected

✅ Secure code example

Resources:
  MyRedisCache:
    Type: 'AWS::ElastiCache::CacheCluster'
    Properties:
      CacheNodeType: 'cache.t2.micro'
      Engine: 'redis'
      NumCacheNodes: '1'
      TransitEncryptionEnabled: true  # Enable in-transit encryption to protect data during transfer