Secure Redis connections in Drupal using password authentication
When using AWS ElastiCache for Redis as a caching backend for your Drupal site, it’s important to protect access to the Redis service—not just with network-level security, but also at the application level using AUTH. This guide focuses on using a single AUTH token with Drupal’s Redis module and the PHPRedis extension, which is the most compatible approach.
Using Redis AUTH Token (Single Password)
AWS ElastiCache Redis supports AUTH token authentication, allowing clients to authenticate with a single password. This is the recommended method for use with PHPRedis, which does not support named user authentication.
✅ How to Enable AUTH Token in AWS
- In the AWS ElastiCache Console, go to your Redis cluster.
- Choose Modify.
- Under Access Control, select Redis AUTH.
- Enter a secure password (minimum 16 characters).
- Save changes and wait for the cluster to update.
You can enable or modify this setting at any time, even after the cluster is live.
Drupal Configuration
In your settings.php:
|
1 2 3 4 5 6 7 |
$settings['redis.connection']['interface'] = 'PhpRedis'; $settings['redis.connection']['host'] = 'tls://your-cluster-endpoint.amazonaws.com'; $settings['redis.connection']['port'] = 6379; $settings['redis.connection']['password'] = 'your-auth-token'; $settings['redis.connection']['timeout'] = 2.5; $settings['redis.connection']['persistent'] = 0; |
This configuration instructs Drupal to connect over TLS and authenticate with the Redis AUTH token.
⚠️ If you see the error
WRONGPASS invalid username-password pair or user is disabled, it likely means the cluster is configured for ACL-based authentication instead of token-based authentication. Ensure that Redis AUTH is enabled and user groups are not assigned.
Troubleshooting
| Error Message | Cause |
|---|---|
WRONGPASS invalid username-password pair or user is disabled |
Cluster is using user group (ACL mode) instead of AUTH token mode |
NOAUTH Authentication required |
Password is missing in settings.php |
| Connection refused | TLS misconfiguration, wrong endpoint, or incorrect port |
Summary
| Feature | Supported |
|---|---|
| Redis AUTH token | ✅ Yes |
| ACLs with named users | ❌ No (not supported by PHPRedis) |
With just a few adjustments to your Drupal config, you can connect securely to AWS ElastiCache Redis using TLS and an AUTH token. This is the simplest and most compatible method when using PHPRedis.
Need help configuring this on your hosting environment? Reach out to Reliable Penguin—we’re happy to assist.
