How to secure Redis cluster on AWS elasticache

A straight forward solution is to use a VPC Network ACL Inbound Rule. This only works if your ELB is in a VPC, but if you've created it in the last few years it should be in the default one.

To ban 1.2.3.4 for example, do the following:

1. Login to AWS.
2. Navigate to VPC.
3. Choose Network ACLs from the left hand menu.
4. Choose the ACL associated with the VPC your ELB is in.
5. Choose the Inbound Rules tab.
6. Choose Edit and add a new rule with the following attributes:
   • Rule #: 50 (any number as long as it's less than the rule that ALLOWs from ALL)
   • Type: ALL Traffic
   • Protocol: ALL
   • Port Range: ALL
   • Source: 1.2.3.4/32
   • Allow / Deny: DENY

There's a bunch more information about Network ACLs here: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html

Unfortunately you can't do this globally. However, for each AWS product that supports it, you typically can limit access to a certain region.

For instance, for EC2, you can do the following:

{
  "Statement":[{
    "Effect":"allow",
    "Action":"RunInstances",
    "Resource":"*",
    "Condition":{
      "StringEquals":{
        "ec2:Region":"us-west-1"
        }
      }
    }
  ]
}

Of course, you'd need to issue a deny rule as well where appropriate.

Here's the documentation for the above.