IAM Policies for ElastiCache
Which permissions to generate based on what the user is doing.
Profile Routing
| Activity | Profile | Key actions |
|---|---|---|
| Connecting from app (Lambda, ECS, EKS) | Connectivity | elasticache:Connect |
| Creating/modifying caches and RBAC | Provisioning | elasticache:Create*, Modify*, Delete* |
| Monitoring, alarms, cost review | Monitoring | elasticache:Describe*, cloudwatch:PutMetricAlarm, ce:GetCostAndUsage |
| Read-only inspection, debugging | Discovery | elasticache:Describe*, elasticache:List* |
| Password rotation Lambda | Rotation | elasticache:ModifyUser, elasticache:DescribeUsers, secretsmanager:GetSecretValue, secretsmanager:PutSecretValue, secretsmanager:DescribeSecret, secretsmanager:UpdateSecretVersionStage, secretsmanager:GetRandomPassword |
ElastiCache-Specific Gotchas
elasticache:Connect requires two ARNs. The Resource list must include both the cache AND the user. Without both, connection is denied:
arn:aws:elasticache:<region>:<account-id>:serverlesscache:<cache-name>
arn:aws:elasticache:<region>:<account-id>:user:<user-id>For node-based, replace serverlesscache with replicationgroup.
KMS condition for at-rest encryption (only if using customer-managed key):
"Condition": { "StringEquals": { "kms:ViaService": "elasticache.<region>.amazonaws.com" } }Required KMS actions: kms:CreateGrant, kms:DescribeKey, kms:GenerateDataKey, kms:Decrypt.
Service-linked role: AWSServiceRoleForElastiCache. First-time account setup needs iam:CreateServiceLinkedRole with condition "iam:AWSServiceName": "elasticache.amazonaws.com". Once created, remove.
SSM tunnel document ARN: arn:aws:ssm:<region>::document/AWS-StartPortForwardingSessionToRemoteHost. Include in connectivity profile only if using SSM port forwarding.
Rotation Lambda must call elasticache.modify_user(UserId=..., Passwords=[new_password]). Note: Passwords is a top-level parameter, not nested inside AuthenticationMode. The rotation Lambda also needs secretsmanager:GetRandomPassword on Resource: "*" (not scoped to a specific secret ARN).
Combining Profiles
| Persona | Profiles |
|---|---|
| Developer | Discovery |
| Platform engineer | Provisioning + Discovery |
| SRE / on-call | Monitoring + Discovery |
| Application runtime | Connectivity only |
Lambda VPC Connectivity
Any Lambda function connecting to ElastiCache in a VPC needs the AWSLambdaVPCAccessExecutionRole managed policy (or equivalent permissions: ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, ec2:DeleteNetworkInterface). Without these, the Lambda will time out connecting to ElastiCache.
