August 14, 2025

Using TLS with Drupal Redis Module and AWS ElastiCache

Secure Redis Caching in Drupal Using PHPRedis and ElastiCache TLS

When using Redis as a caching layer for Drupal, encrypting the connection between your application and the Redis backend is a security best practice—especially when operating in cloud environments. Fortunately, AWS ElastiCache for Redis enables in-transit encryption (TLS) by default on newer clusters and uses the standard Redis port 6379.

This guide explains how to configure the Drupal Redis module to connect securely to AWS ElastiCache Redis using PHPRedis with TLS.

Prerequisites

Drupal 9 or 10 site
Redis module installed and enabled
PHPRedis extension (php-redis) installed with TLS support
An ElastiCache Redis cluster with in-transit encryption enabled (default on Redis 6+)

Step 1: Confirm ElastiCache Cluster Uses In-Transit Encryption

When creating your ElastiCache cluster in AWS:

Ensure Encryption in transit is set to Enabled
The cluster will use port 6379 for TLS connections
TLS is enabled by default for Redis 6 and later

Once TLS is enabled on a cluster, all connections must use TLS. Non-TLS connections will be rejected.

Step 2: Configure Drupal to Use Redis Over TLS

Update your settings.php with the correct configuration. Instead of specifying a scheme option, PHPRedis uses a tls:// prefix on the host name to initiate a secure connection.

$settings['redis.connection']['interface'] = 'PhpRedis';
$settings['redis.connection']['host'] = 'tls://your-elasticache-primary-endpoint.amazonaws.com';
$settings['redis.connection']['port'] = 6379;
$settings['redis.connection']['timeout'] = 2.5;
$settings['redis.connection']['persistent'] = 0;

$settings['redis.connection']['interface'] = 'PhpRedis';

$settings['redis.connection']['host'] = 'tls://your-elasticache-primary-endpoint.amazonaws.com';

$settings['redis.connection']['port'] = 6379;

$settings['redis.connection']['timeout'] = 2.5;

$settings['redis.connection']['persistent'] = 0;

This instructs PHPRedis to use TLS when connecting. No additional SSL context or certificates are required when using AWS ElastiCache.

Step 3: Clear Cache and Test

After updating your configuration, rebuild the cache:

drush cr

drush cr

Check the Drupal log (dblog) or web server logs to confirm there are no connection errors. You can also verify Redis usage by setting and retrieving a cache value via \Drupal::cache()->set() and ->get().

Common Issues

Problem	Solution
Connection refused	Ensure security group allows access to port 6379 and that you’re using the correct endpoint
Unexpected response or error	Double-check that TLS is enabled on the ElastiCache cluster and that the `tls://` prefix is used in the host

Summary

To use TLS with Redis in Drupal via AWS ElastiCache:

Make sure your ElastiCache Redis cluster has in-transit encryption enabled.
Use the tls:// prefix on the Redis host in your settings.php.
Drupal will now connect to Redis over an encrypted channel using PHPRedis—no additional SSL config needed.

If you need help configuring Redis for your Drupal environment or want to review the security of your AWS-hosted stack, contact Reliable Penguin for expert assistance.