Secure Redis Caching in Drupal Using PHPRedis and ElastiCache TLS
When using Redis as a caching layer for Drupal, encrypting the connection between your application and the Redis backend is a security best practice—especially when operating in cloud environments. Fortunately, AWS ElastiCache for Redis enables in-transit encryption (TLS) by default on newer clusters and uses the standard Redis port 6379.
This guide explains how to configure the Drupal Redis module to connect securely to AWS ElastiCache Redis using PHPRedis with TLS.
Prerequisites
- Drupal 9 or 10 site
- Redis module installed and enabled
- PHPRedis extension (
php-redis) installed with TLS support - An ElastiCache Redis cluster with in-transit encryption enabled (default on Redis 6+)
Step 1: Confirm ElastiCache Cluster Uses In-Transit Encryption
When creating your ElastiCache cluster in AWS:
- Ensure Encryption in transit is set to Enabled
- The cluster will use port 6379 for TLS connections
- TLS is enabled by default for Redis 6 and later
Once TLS is enabled on a cluster, all connections must use TLS. Non-TLS connections will be rejected.
Step 2: Configure Drupal to Use Redis Over TLS
Update your settings.php with the correct configuration. Instead of specifying a scheme option, PHPRedis uses a tls:// prefix on the host name to initiate a secure connection.
|
1 2 3 4 5 6 |
$settings['redis.connection']['interface'] = 'PhpRedis'; $settings['redis.connection']['host'] = 'tls://your-elasticache-primary-endpoint.amazonaws.com'; $settings['redis.connection']['port'] = 6379; $settings['redis.connection']['timeout'] = 2.5; $settings['redis.connection']['persistent'] = 0; |
This instructs PHPRedis to use TLS when connecting. No additional SSL context or certificates are required when using AWS ElastiCache.
Step 3: Clear Cache and Test
After updating your configuration, rebuild the cache:
|
1 2 |
drush cr |
Check the Drupal log (dblog) or web server logs to confirm there are no connection errors. You can also verify Redis usage by setting and retrieving a cache value via \Drupal::cache()->set() and ->get().
Common Issues
| Problem | Solution |
|---|---|
| Connection refused | Ensure security group allows access to port 6379 and that you’re using the correct endpoint |
| Unexpected response or error | Double-check that TLS is enabled on the ElastiCache cluster and that the tls:// prefix is used in the host |
Summary
To use TLS with Redis in Drupal via AWS ElastiCache:
- Make sure your ElastiCache Redis cluster has in-transit encryption enabled.
- Use the
tls://prefix on the Redis host in yoursettings.php. - Drupal will now connect to Redis over an encrypted channel using PHPRedis—no additional SSL config needed.
If you need help configuring Redis for your Drupal environment or want to review the security of your AWS-hosted stack, contact Reliable Penguin for expert assistance.
