Project: KICS (Provisioning / Security & Compliance)
File: 323db967-c68e-44e6-916c-a777f95af34b.md

title: ElastiCache Using Default Port hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 323db967-c68e-44e6-916c-a777f95af34b Query name: ElastiCache Using Default Port Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: ElastiCache should not use the default port (an attacker can easily guess the port). For engine set to Redis, the default port is 6379. The Memcached default port is 11211<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="12" Resources: BasicReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AutomaticFailoverEnabled: true CacheNodeType: cache.r3.large CacheSubnetGroupName: !Ref CacheSubnetGroup Engine: redis EngineVersion: '3.2' NumNodeGroups: '2' ReplicasPerNodeGroup: '3' Port: 6379 PreferredMaintenanceWindow: 'sun:05:00-sun:09:00' ReplicationGroupDescription: A sample replication group SecurityGroupIds: !Ref ReplicationGroupSG SnapshotRetentionLimit: 5 SnapshotWindow: '10:00-12:00' ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="12" Resources: BasicReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AutomaticFailoverEnabled: true CacheNodeType: cache.r3.large CacheSubnetGroupName: !Ref CacheSubnetGroup Engine: memcached EngineVersion: '3.2' NumNodeGroups: '2' ReplicasPerNodeGroup: '3' Port: 11211 PreferredMaintenanceWindow: 'sun:05:00-sun:09:00' ReplicationGroupDescription: A sample replication group SecurityGroupIds: !Ref ReplicationGroupSG SnapshotRetentionLimit: 5 SnapshotWindow: '10:00-12:00' ``` ```json title="Positive test num. 3 - json file" hl_lines="15" { "Resources": { "BasicReplicationGroup": { "Type": "AWS::ElastiCache::ReplicationGroup", "Properties": { "AutomaticFailoverEnabled": true, "CacheNodeType": "cache.r3.large", "CacheSubnetGroupName": { "Ref": "CacheSubnetGroup" }, "Engine": "redis", "EngineVersion": "3.2", "NumNodeGroups": "2", "ReplicasPerNodeGroup": "3", "Port": 6379, "PreferredMaintenanceWindow": "sun:05:00-sun:09:00", "ReplicationGroupDescription": "A sample replication group", "SecurityGroupIds": [ { "Ref": "ReplicationGroupSG" } ], "SnapshotRetentionLimit": 5, "SnapshotWindow": "10:00-12:00" } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="15" { "Resources": { "BasicReplicationGroup": { "Type": "AWS::ElastiCache::ReplicationGroup", "Properties": { "AutomaticFailoverEnabled": true, "CacheNodeType": "cache.r3.large", "CacheSubnetGroupName": { "Ref": "CacheSubnetGroup" }, "Engine": "memcached", "EngineVersion": "3.2", "NumNodeGroups": "2", "ReplicasPerNodeGroup": "3", "Port": 11211, "PreferredMaintenanceWindow": "sun:05:00-sun:09:00", "ReplicationGroupDescription": "A sample replication group", "SecurityGroupIds": [ { "Ref": "ReplicationGroupSG" } ], "SnapshotRetentionLimit": 5, "SnapshotWindow": "10:00-12:00" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" Resources: BasicReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AutomaticFailoverEnabled: true CacheNodeType: cache.r3.large CacheSubnetGroupName: !Ref CacheSubnetGroup Engine: redis EngineVersion: '3.2' NumNodeGroups: '2' ReplicasPerNodeGroup: '3' Port: 6380 PreferredMaintenanceWindow: 'sun:05:00-sun:09:00' ReplicationGroupDescription: A sample replication group SecurityGroupIds: !Ref ReplicationGroupSG SnapshotRetentionLimit: 5 SnapshotWindow: '10:00-12:00' ``` ```yaml title="Negative test num. 2 - yaml file" Resources: BasicReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AutomaticFailoverEnabled: true CacheNodeType: cache.r3.large CacheSubnetGroupName: !Ref CacheSubnetGroup Engine: memcached EngineVersion: '3.2' NumNodeGroups: '2' ReplicasPerNodeGroup: '3' Port: 11212 PreferredMaintenanceWindow: 'sun:05:00-sun:09:00' ReplicationGroupDescription: A sample replication group SecurityGroupIds: !Ref ReplicationGroupSG SnapshotRetentionLimit: 5 SnapshotWindow: '10:00-12:00' ``` ```json title="Negative test num. 3 - json file" { "Resources": { "BasicReplicationGroup": { "Type": "AWS::ElastiCache::ReplicationGroup", "Properties": { "AutomaticFailoverEnabled": true, "CacheNodeType": "cache.r3.large", "CacheSubnetGroupName": { "Ref": "CacheSubnetGroup" }, "Engine": "redis", "EngineVersion": "3.2", "NumNodeGroups": "2", "ReplicasPerNodeGroup": "3", "Port": 6380, "PreferredMaintenanceWindow": "sun:05:00-sun:09:00", "ReplicationGroupDescription": "A sample replication group", "SecurityGroupIds": [ { "Ref": "ReplicationGroupSG" } ], "SnapshotRetentionLimit": 5, "SnapshotWindow": "10:00-12:00" } } } } ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "Resources": { "BasicReplicationGroup": { "Type": "AWS::ElastiCache::ReplicationGroup", "Properties": { "AutomaticFailoverEnabled": true, "CacheNodeType": "cache.r3.large", "CacheSubnetGroupName": { "Ref": "CacheSubnetGroup" }, "Engine": "memcached", "EngineVersion": "3.2", "NumNodeGroups": "2", "ReplicasPerNodeGroup": "3", "Port": 11212, "PreferredMaintenanceWindow": "sun:05:00-sun:09:00", "ReplicationGroupDescription": "A sample replication group", "SecurityGroupIds": [ { "Ref": "ReplicationGroupSG" } ], "SnapshotRetentionLimit": 5, "SnapshotWindow": "10:00-12:00" } } } } ``` </details>