ElastiCache

Type: rvn-elasticache · Latest version: 0.1.3

Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.

Readme

Creates and manages Amazon ElastiCache for Redis, Valkey, Memcached, or serverless Redis-compatible caches.

Overview

Use this module when an application needs a managed in-memory cache in AWS. It provisions ElastiCache in a selected Ravion VPC network with subnet placement, security group access, optional Redis or Valkey authentication, encryption controls, backups, CloudWatch alarms, and a Secrets Manager connection string. The module supports provisioned Redis, Valkey, and Memcached caches. It also supports ElastiCache Serverless for Redis-compatible engines when you want AWS-managed scaling instead of fixed node capacity.

Use cases

Scenario	Benefit
Application cache	Create a private Redis, Valkey, or Memcached cache attached to an existing Ravion VPC network.
Production Redis-compatible cache	Enable replicas, automatic failover, Multi-AZ, encryption, backups, and CloudWatch alarms.
Serverless cache	Use ElastiCache Serverless for Redis or Valkey workloads with data storage and ECPU usage limits.
Shared connection details	Store the cache connection string in AWS Secrets Manager for application services to consume.

Networking and access

Select a VPC network first. Ravion maps the network’s AWS account, region, VPC ID, and private subnet IDs into this module. The cache subnet group or serverless cache uses those private subnets by default. Security group creation is enabled by default. Add allowed security group IDs for application services that should connect to the cache. IPv4 and IPv6 CIDR access is available for controlled network ranges, but security group references are usually safer for application-to-cache traffic.

Engine and capacity

Choose Valkey for Redis-compatible workloads unless you specifically need Redis OSS. AWS prices Valkey 20% lower than Redis OSS for node-based ElastiCache and 33% lower for ElastiCache Serverless, with a 90% lower Serverless minimum data storage size. Choose Redis when you have a Redis OSS compatibility requirement, or Memcached for simple volatile object caching without Redis data structures. Provisioned Redis and Valkey support replicas, optional cluster mode sharding, automatic failover, Multi-AZ, backups, AUTH tokens, and encryption. Memcached uses cache node count instead of Redis-style replication groups. For provisioned caches, choose a node type such as cache.t4g.micro or cache.r7g.large. For serverless caches, set the data storage maximum and ECPU per second maximum to control cost and capacity limits.

Security

Transit encryption and at-rest encryption default on for Redis and Valkey. AUTH token generation is enabled by default when transit encryption is enabled. You can provide a specific token when required, but generated tokens avoid hardcoding credentials in Ravion configuration. The module can create a Secrets Manager secret with the cache connection string. Keep this enabled when application modules need a stable secret reference for connecting to the cache.

Backups and maintenance

Redis and Valkey provisioned caches can retain automatic snapshots for up to 35 days and can create a final snapshot during deletion when a final snapshot identifier is provided. Serverless caches can restore from snapshot ARNs and can set a daily snapshot time. Maintenance windows, immediate apply, and automatic minor version upgrades control when AWS applies compatible engine and infrastructure changes for provisioned caches.

Observability

CloudWatch dashboard metrics are shown for provisioned Redis or Valkey, Memcached, and serverless caches. CloudWatch alarms are optional. When enabled, the module can alarm on CPU utilization, memory usage, current connections, and evictions.

Configuration

Field	Required	Default	Notes
VPC network	Yes	None	Supplies AWS account, region, VPC ID, and private subnet IDs.
Name slug	Yes	Project and environment given IDs	Prefix for ElastiCache resources.
Engine	Yes	valkey	Valkey is the recommended default for Redis-compatible workloads because AWS prices it 20% lower than Redis OSS for node-based caches and 33% lower for Serverless.
Serverless	No	false	Creates an ElastiCache Serverless cache for Redis or Valkey.
Engine major version	Yes	None	Current latest major versions include Valkey 9, Redis OSS 7, and Memcached 1.6.
Engine minor version	Yes	None	Appended to the major version. Use 0 for Valkey 9.0, 1 for Redis OSS 7.1, or 22 for Memcached 1.6.22.
Node type	Yes for provisioned caches	cache.t4g.micro	ElastiCache node size for provisioned clusters.
Cache nodes	No	1	Memcached node count.
Cluster mode	No	false	Enables Redis or Valkey sharding when one primary shard is not enough for data size or throughput.
Node groups	No	1	Redis or Valkey shard count. Only shown when cluster mode is enabled.
Replicas per node group	No	0	Replica count per Redis or Valkey shard.
Security group creation	No	true	Creates ingress rules from allowed security groups and CIDRs.
Transit encryption	No	true	Applies to Redis and Valkey. Required for AUTH tokens.
At-rest encryption	No	true	Applies to Redis and Valkey.
AUTH token generation	No	true	Generates a Redis or Valkey AUTH token when no explicit token is provided.
Automatic failover	No	false	Requires at least one Redis or Valkey replica.
Multi-AZ	No	false	Spreads Redis or Valkey replicas across availability zones.
Snapshot retention days	No	0	Set 1-35 for automatic Redis or Valkey backups.
Serverless usage limits	No	10 GB and 5000 ECPU/s	Applies only to serverless caches.
Connection string secret	No	true	Stores cache connection details in Secrets Manager.
CloudWatch alarms	No	false	Adds CPU, memory, connection, and eviction alarms.
Tags	No	Standard Ravion tags	Additional tags merged with Ravion ownership and identity tags.
Advanced Terraform variables	No	Empty object	Escape hatch for one-off Terraform variable overrides.

Advanced configuration

Use parameter group settings for engine parameters such as Redis eviction policy or Memcached options. Use notification topic ARN to send ElastiCache events to an SNS topic. Use advanced Terraform variables for one-off overrides not represented directly in the UI. Values in advanced Terraform variables override generated variables. Terraform settings let you override the OpenTofu version, Terraform execution environment inherited from the VPC network, and Ravion state backend workspace name.

Design decisions

The module places caches in private subnets by default through the VPC network reference. Redis and Valkey encryption, AUTH token generation, security group creation, and connection string secret creation default on because they are safer defaults for application caches. The normal form exposes common sizing, security, availability, backup, observability, and secret settings. Rare settings such as global replication group attachment and log delivery configuration are intentionally left to advanced Terraform variables.

Learn more

Inputs reference

All inputs for rvn-elasticache version 0.1.3. Use the name shown for each field as the input key in module config.

network

$ref:rvn-aws-network

required

VPC network.

Immutable after creation

Cache

name

string

required

Name slug. Name prefix for all ElastiCache resources.

Default: <<project.given_id>>-<<environment.given_id>>
Immutable after creation
Pattern: ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$ — 1-40 lowercase letters, numbers, and hyphens. Start and end with a letter or number.

Version

engine

string

required

Engine. Choose Valkey for Redis-compatible workloads with lower AWS pricing, Redis for Redis OSS compatibility requirements, or Memcached for simple non-persistent object caching without Redis data structures. AWS prices Valkey 20% lower than Redis OSS for node-based ElastiCache and 33% lower for Serverless, with a 90% lower Serverless minimum data storage size.

Default: valkey
Allowed values: valkey (Valkey), redis (Redis), memcached (Memcached)
Immutable after creation

engine_major_version

string

required

Engine major version. Major engine version. Current latest major versions include Valkey 9, Redis OSS 7, and Memcached 1.6.

Immutable after creation

engine_minor_version

string

required

Engine minor version. Minor or patch version appended to the major version.

minor_version_auto_upgrade_enabled

boolean

Auto minor version upgrades. Enable automatic minor engine version upgrades during the maintenance window.

Default: true
Shown when: {"serverless_enabled":false}

Size & topology

serverless_enabled

boolean

Serverless. Create an ElastiCache Serverless cache instead of provisioned nodes. Supported for Redis and Valkey.

Default: false
Immutable after creation
Shown when: {"engine":["redis","valkey"]}

node_type

string

required

Node type. ElastiCache node size for provisioned clusters.

Default: cache.t4g.micro
Pattern: ^cache\..+ — Node type must start with cache.
Shown when: {"serverless_enabled":false}

num_cache_nodes

number

Cache nodes. Number of Memcached cache nodes.

Default: 1
Min: 1
Max: 40
Shown when: {"engine":"memcached","serverless_enabled":false}

cluster_mode_enabled

boolean

Cluster mode. Enable cluster mode when one primary shard is not enough for your data size or throughput. Leave disabled for simpler Redis or Valkey deployments with one primary and optional replicas.

Default: false
Shown when: {"engine":["redis","valkey"],"serverless_enabled":false}

num_node_groups

number

Node groups. Number of Redis or Valkey shards. Use 1 when cluster mode is disabled.

Default: 1
Min: 1
Max: 500
Shown when: {"cluster_mode_enabled":true,"engine":["redis","valkey"],"serverless_enabled":false}

replicas_per_node_group

number

Replicas per node group. Number of replica nodes in each Redis or Valkey node group.

Default: 0
Min: 0
Max: 5
Shown when: {"engine":["redis","valkey"],"serverless_enabled":false}

port

number

Port. Port where the cache accepts connections. Leave blank for engine defaults.

Min: 1
Max: 65535

network_type

string

Network type. Network type for the replication group.

Default: ipv4
Allowed values: ipv4 (IPv4), ipv6 (IPv6), dual_stack (Dual stack)
Shown when: {"serverless_enabled":false}

ip_discovery

string

IP discovery. IP address discovery method.

Default: ipv4
Allowed values: ipv4 (IPv4), ipv6 (IPv6)
Shown when: {"serverless_enabled":false}

Security

security_group_creation_enabled

boolean

Security group creation. Create a security group with ingress rules for this cache.

Default: true

security_group_id

string

required

Security group ID. Existing security group ID to use when security group creation is disabled.

Pattern: ^sg-.+ — Security group ID must start with sg-.
Shown when: {"security_group_creation_enabled":false}

allowed_security_group_ids

string_array

Allowed security groups. Security groups allowed to connect to this cache.

Pattern: ^sg-.+ — Security group ID must start with sg-.

allowed_cidr_blocks

string_array

Allowed IPv4 CIDR blocks. IPv4 CIDR blocks allowed to connect to this cache.

allowed_ipv6_cidr_blocks

string_array

Allowed IPv6 CIDR blocks. IPv6 CIDR blocks allowed to connect to this cache.

transit_encryption_enabled

boolean

Transit encryption. Enable TLS encryption for Redis and Valkey traffic.

Default: true
Shown when: {"engine":["redis","valkey"]}

at_rest_encryption_enabled

boolean

At-rest encryption. Enable encryption at rest for Redis and Valkey.

Default: true
Shown when: {"engine":["redis","valkey"]}

kms_key_arn

string

KMS key ARN. KMS key ARN for at-rest encryption. Leave blank to use the AWS managed key.

Shown when: {"at_rest_encryption_enabled":true,"engine":["redis","valkey"]}

auth_token_enabled

boolean

AUTH token generation. Generate an AUTH token for Redis or Valkey when no token is provided. Requires transit encryption.

Default: true
Shown when: {"engine":["redis","valkey"],"transit_encryption_enabled":true}

auth_token

string

AUTH token. Optional explicit AUTH token. Leave blank to generate one when AUTH token generation is enabled.

Shown when: {"engine":["redis","valkey"],"transit_encryption_enabled":true}

auth_token_length

number

AUTH token length. Length of the generated AUTH token.

Default: 32
Min: 16
Max: 128
Shown when: {"auth_token_enabled":true,"engine":["redis","valkey"],"transit_encryption_enabled":true}

Availability

automatic_failover_enabled

boolean

Automatic failover. Enable automatic failover. Requires at least one replica.

Default: false
Shown when: {"engine":["redis","valkey"],"serverless_enabled":false}

multi_az_enabled

boolean

Multi-AZ. Enable Multi-AZ support for the replication group.

Default: false
Shown when: {"engine":["redis","valkey"],"serverless_enabled":false}

data_tiering_enabled

boolean

Data tiering. Enable data tiering for r6gd or r7gd node types.

Default: false
Shown when: {"engine":["redis","valkey"],"serverless_enabled":false}

Backups

snapshot_retention_limit

number

Snapshot retention days. Number of days to retain automatic snapshots. Set to 0 to disable backups.

Default: 0
Min: 0
Max: 35
Shown when: {"engine":["redis","valkey"],"serverless_enabled":false}

snapshot_window

string

Snapshot window. Daily UTC window for automatic snapshots.

Shown when: {"engine":["redis","valkey"],"serverless_enabled":false}

final_snapshot_identifier

string

Final snapshot identifier. Final snapshot name to create when deleting the replication group. Leave blank to skip final snapshot creation.

Shown when: {"engine":["redis","valkey"],"serverless_enabled":false}

serverless_snapshot_arns_to_restore

string_array

Serverless snapshot ARNs to restore. Snapshot ARNs to restore into the serverless cache.

Shown when: {"engine":["redis","valkey"],"serverless_enabled":true}

serverless_daily_snapshot_time

string

Serverless daily snapshot time. Daily UTC time for serverless automated snapshots.

Shown when: {"engine":["redis","valkey"],"serverless_enabled":true}

Serverless usage limits

serverless_data_storage_maximum

number

Data storage maximum (GB). Maximum serverless data storage in GB.

Default: 10
Min: 1
Max: 5000
Shown when: {"serverless_enabled":true}

serverless_ecpu_per_second_maximum

number

ECPU per second maximum. Maximum serverless ECPU per second.

Default: 5000
Min: 1000
Max: 15000000
Shown when: {"serverless_enabled":true}

serverless_security_group_ids

string_array

Serverless security groups. Security groups to associate with the serverless cache. Leave blank to use this module’s security group.

Pattern: ^sg-.+ — Security group ID must start with sg-.
Shown when: {"serverless_enabled":true}

Maintenance

maintenance_window

string

Maintenance window. Weekly UTC maintenance window.

Shown when: {"serverless_enabled":false}

immediate_apply_enabled

boolean

Apply immediately. Apply changes immediately instead of during the next maintenance window.

Default: false
Shown when: {"serverless_enabled":false}

Parameter group

parameter_group_family

string

Parameter group family. Parameter group family. Leave blank to derive it from engine and version.

Shown when: {"serverless_enabled":false}

parameters

object_array

Parameters. Parameter name/value pairs for the ElastiCache parameter group.

Default: []
Shown when: {"serverless_enabled":false}

Show item fields

name

string

required

Name.

value

string

required

Value.

Notifications

notification_topic_arn

string

Notification topic ARN. SNS topic ARN for ElastiCache notifications.

Shown when: {"serverless_enabled":false}

Secrets Manager

secret_creation_enabled

boolean

Connection string secret. Create a Secrets Manager secret containing the cache connection string.

Default: true

secret_name

string

Secret name. Secret name. Leave blank to use the generated connection string secret name.

Shown when: {"secret_creation_enabled":true}

secret_kms_key_arn

string

Secret KMS key ARN. KMS key ARN used to encrypt the connection string secret.

Shown when: {"secret_creation_enabled":true}

secret_recovery_window_in_days

number

Secret recovery window (days). Days AWS Secrets Manager waits before deleting the secret. Set to 0 for immediate deletion.

Default: 7
Min: 0
Max: 30
Shown when: {"secret_creation_enabled":true}

Observability

cloudwatch_alarms_creation_enabled

boolean

CloudWatch alarms. Create CloudWatch alarms for CPU, memory, connections, and evictions.

Default: false

cloudwatch_alarm_cpu_threshold

number

CPU alarm threshold (%). CPU utilization threshold in percent.

Default: 80
Min: 0
Max: 100
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_memory_threshold

number

Memory alarm threshold (%). Memory utilization threshold in percent.

Default: 80
Min: 0
Max: 100
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_connections_threshold

number

Connections alarm threshold. Current connections alarm threshold.

Default: 1000
Min: 1
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_evictions_threshold

number

Evictions alarm threshold. Evictions alarm threshold.

Default: 100
Min: 0
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_evaluation_periods

number

Alarm evaluation periods. Number of periods over which CloudWatch compares alarm data to the threshold.

Default: 2
Min: 1
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_period

number

Alarm period. Alarm period in seconds.

Default: 300
Allowed values: 10 (10 seconds), 30 (30 seconds), 60 (60 seconds), 300 (5 minutes), 900 (15 minutes), 3600 (1 hour)
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_actions

string_array

Alarm actions. ARNs to notify when an alarm transitions to ALARM.

Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_ok_actions

string_array

OK actions. ARNs to notify when an alarm transitions to OK.

Shown when: {"cloudwatch_alarms_creation_enabled":true}

Misc

Terraform settings

opentofu_version

string

OpenTofu version override. Override the environment’s default version for this module

ravion_state_backend_workspace

string

Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

Immutable after creation

advanced_terraform_variables

object

Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

Default: {}

Introduction

Use cases

Concepts

Config as code

Migrate

Modules

Pipelines

Guides

Module definitions

Dependencies and consumers

Readme

Overview

Use cases

Networking and access

Engine and capacity

Security

Backups and maintenance

Observability

Configuration

Advanced configuration

Design decisions

Learn more

Inputs reference

Cache

Version

Size & topology

Security

Availability

Backups

Serverless usage limits

Maintenance

Parameter group

Notifications

Secrets Manager

Observability

Misc

Terraform settings

​Dependencies and consumers

​Readme

​Overview

​Use cases

​Networking and access

​Engine and capacity

​Security

​Backups and maintenance

​Observability

​Configuration

​Advanced configuration

​Design decisions

​Learn more

​Inputs reference

​Cache

​Version

​Size & topology

​Security

​Availability

​Backups

​Serverless usage limits

​Maintenance

​Parameter group

​Notifications

​Secrets Manager

​Observability

​Misc

​Terraform settings

Dependencies and consumers

Readme

Overview

Use cases

Networking and access

Engine and capacity

Security

Backups and maintenance

Observability

Configuration

Advanced configuration

Design decisions

Learn more

Inputs reference

Cache

Version

Size & topology

Security

Availability

Backups

Serverless usage limits

Maintenance

Parameter group

Notifications

Secrets Manager

Observability

Misc

Terraform settings