ElastiCache
Amazon ElastiCache is the AWS managed in-memory data store. The Web App Blueprint uses its Redis engine as the application cache, one replication group per stage, with encryption on both at rest and in transit.
What it does
ElastiCache runs Redis or Memcached nodes for you: provisioning, patching, backups and, for Redis, replication and automatic failover. A Redis replication group has one primary node and optional replicas; clients write to the primary endpoint and read from either.
How BuiltForProd uses it
The elasticache unit in acme-aws-blueprint-webapp-infra wraps the registry module terraform-aws-modules/elasticache/aws 1.11.1 and creates replication group acme-usw2-dev-redis (Redis 7.1 on cache.t3.micro nodes). The VPC and private subnet ids come from the Parameter Store entries the AWS Baseline publishes, and the module's own security group allows port 6379 from the organization's private address space only.
Two per-stage values in environments/<stage>/us-west-2/terragrunt.stack.hcl decide resilience:
| Stage | Nodes | Multi-AZ with automatic failover |
|---|---|---|
| dev | 1 | off |
| staging | 2 | on |
| prod | 2 | on |
With two nodes the replica sits in another availability zone and the registry module turns failover on. Encryption at rest and in transit are always on. The primary endpoint is published to Parameter Store as /acme/usw2/dev/elasticache/endpoint.
From there the path to the application is the same as for DocumentDB. The Helm chart's ExternalSecret in acme-aws-blueprint-webapp-gitops pulls the parameter into the Kubernetes Secret blueprint-app-secrets, the deployment injects it as REDIS_HOST, and the application's readiness probe GET /ready checks Redis alongside the database. The NetworkPolicy in the chart allows egress on port 6379 only to the data store address ranges.
Terms you will see
| Term | Meaning |
|---|---|
| Replication group | A Redis primary plus its replicas, addressed by one primary endpoint. |
| Node type | The instance size of each cache node, here cache.t3.micro. |
| Multi-AZ | Replicas placed in other availability zones so a zone failure triggers failover. |
| In-transit encryption | TLS between the application and Redis. |
| Subnet group | The list of private subnets the nodes may be placed in. |
Where to read more
- Web App Blueprint overview
- DocumentDB for the database next to it
- External Secrets Operator for how the endpoint reaches the pod
- VPC for the private subnets it lives in