A Serverless Valkey Cache That Is Not Open to Its Whole Network
ElastiCache Serverless for Valkey. With no user group, any client that reaches the endpoint connects as the default user with no password, so this module always attaches a Valkey user group whose users sign in with IAM. It sets a storage and ECPU ceiling, since AWS sets none, and keeps 7 days of snapshots. It also says destroy takes no final snapshot.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-16 · how we verify
Use it from the registry
terraform · opentofumodule "elasticache_serverless" {
source = "www.iac-bazaar.com/iac-bazaar/aws-elasticache-serverless/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-elasticache-serverless
ElastiCache Serverless for Valkey. Works with Terraform and OpenTofu
(>= 1.6), aws provider >= 6.0, < 7.0.
A serverless cache with no user group is open to its whole network. Every
client that reaches the endpoint connects as the built-in default user, with
no password, and access control lists are the only access control a serverless
cache has. This module always attaches a Valkey user group, which switches the
default user off, and requires at least one user.
No passwords. Every user authenticates with IAM: the client signs a
short-lived token as its IAM role and sends it as the password. The module
outputs, per user, the IAM policy that role needs (connect_policy_json) and
the user name to send (usernames). AWS rejects a token older than 15 minutes
and disconnects an IAM connection after 12 hours unless it re-authenticates, so
use a client with a credentials provider.
Valkey only. A Redis OSS user group must contain a default user, which would put the open user back.
A cost ceiling is set by default. With no maximum a serverless cache scales, and bills, to 5,000 GB and 15 million ECPUs per second. The defaults here are 10 GB and 100,000 ECPUs per second. At the storage limit Valkey evicts keys that have a TTL, then answers writes with an out-of-memory error; above the ECPU limit requests are throttled.
Snapshots are on. AWS leaves automatic snapshots off; this module keeps 7
days. tofu destroy takes no final snapshot (the provider sends none), so
take a manual one first if the data matters.
Clients need TLS and both ports. AWS turns in-transit encryption on for every serverless cache. The endpoint listens on 6379 (primary) and 6380 (reads from replicas), and many clients open both, so the security group allows both.
Some changes replace the cache: name, subnet_ids, network_type,
kms_key_arn, and a lower major_engine_version.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-keyspaces
point_in_time_recovery defaults to DISABLED and Keyspaces has no snapshots or automated backups, so off means a dropped table is simply gone. PITR on, a customer-managed key, and the two one-way doors - client-side timestamps and TTL - named rather than set quietly.
aws-database-proxy
Amazon RDS Proxy in front of an RDS instance or Aurora cluster: TLS required, clients authenticate with IAM tokens while the proxy reads the password from Secrets Manager, through a role limited to those secrets. Debug logging writes SQL statement text to the logs, so it is off unless that is accepted. End-to-end IAM removes the stored password entirely.
aws-dax-cache
DynamoDB Accelerator with TLS and encryption at rest. DAX leaves both off by default, and neither can be turned on for an existing cluster, so a fix means a new cluster. This module also creates its own security group (DAX otherwise uses the VPC default), a service role limited to the named tables and their indexes, and states that writes bypassing DAX leave stale reads until the TTL.
aws-neptune
Neptune has no user, no password and no GRANT. Authorization is IAM and it defaults to OFF, so anything that can reach port 8182 can read every edge and drop the lot. IAM auth on, storage encrypted, and the audit log driven from one variable because its two halves live in different resources and either alone logs nothing.
aws-dms
ssl_mode defaults to none in AWS, so a task reads your entire production database and writes it elsewhere unencrypted. This defaults to require, refuses none unless stated, and pushes the credential into Secrets Manager rather than state.
aws-quicksight
A QuickSight subscription on Enterprise edition through IAM Identity Center, with admin, author and reader groups, termination protection on because unsubscribing deletes every dashboard, and a VPC connection with its own role so a private database stays private. The authentication method is permanent; Standard edition and QuickSight-managed users are accepted by name.