Elasticache
General Info¶
- Description
-
- Service that simplifies the setup and management of distributed IN-MEMORY caching environments
- Pay
- Provisioned compute resources
- Storage (charged according to compute resources)
Cache Engines
Engine | Description |
---|---|
MEMCACHED |
|
REDIS |
|
Operations¶
- Node Types
-
- Derived from subset of EC2 instance type
T2
= development & occasional burstsM3
= good mixT3
= memory-intensive workloads
- Autodiscovery
-
- For MEMCACHED clusters partitioned across multiple nodes
- Gives apps the ability to identify automatically all nodes in the cluster
- Works with scaling
Scaling
HORIZONTAL |
|
VERTICAL |
|
- Replication
-
- Performed asynchronously
- Goals
- Rapid recovery of node failure
- Serve high volumes of reads
- MEMCACHED
- Standalone in-memory services
- No redundant data protection services
- REDIS
- Supports both goals with replication groups
- Multi-AZ Replication Groups
- Allow to increase availability and minimise loss of data
- Failure of primary node → read replica promoted to new primary + new node provisioned to replace the failed one + update DNS of new primary
- Backup
-
- MEMCACHED
- Snapshots cannot be created
- REDIS
- Allows to persist data on disk & to create a snapshot
- SNAPSHOT = full clone of the data, stored in S3
AUTOMATIC
= setup a replication group & perform snapshot against a read replicaMANUAL
= stored indefinitely until you delete them
- MEMCACHED
Security¶
- Access Control
-
- Restrict INBOUND network access
- Using SGs
- Control network access to cache cluster
- By default network access is off
- For apps to access the cluster → explicitly enable access in specific EC2 SG
- When deployed in a VPC, each node will be issued a private IP address
- Nodes can never be accessed from the Internet or from EC2 outside the VPC
- Using SGs
- Further restrict at the SUBNET LEVEL via ACLs
- Access to manage the config of the cluster is controlled separately (via IAM) from access to the actual memcached/redis service endpoint
- Restrict INBOUND network access