Cannot Connect To AWS Elasticache Redis Cluster From Local Machine

Question

I recently created a Redis cluster on AWS elasticache and am having trouble connecting via redis-cli from my local machine. Every time I run the command:

redis-cli -h <redis_cluster_domain> -p 6379

the connection is never established and eventually exits due to timeout.

Eventually, I figured it's blocking due to a setting on the security group, so I edited the inbound rules to allow all traffic from my IP address. Even after doing this I still cannot connect to the cluster. Any ideas why this might be?

https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/GettingStarted.ConnectToCacheNode.html — noninertialframe, Oct 15 '21 at 17:48
Do you have authentication enabled? Is it in a VPC? We need more detail. — Ermiya Eskandary, Oct 15 '21 at 18:31
@ErmiyaEskandary authentication is currently not enabled on this cluster and it is in a VPC. The VPC has IPv4 CIDRs enabled as well. Quick & dumb question - does my IP address need to be within the CIDR range? — Aaron Mednick, Oct 15 '21 at 19:40
Which CIDR range? If you defined one inside the inbound rules, then yes of course - get your current public IP and change the inbound rule to allow your IP - does that work? — Ermiya Eskandary, Oct 15 '21 at 19:42
@ErmiyaEskandary I'm assuming the ip has to be within the CIDR range of the VPC and the subnet. Trying this now...let's see if it works. (I had to create a new subnet, VPC, security group, and redis cluster) — Aaron Mednick, Oct 15 '21 at 19:56
Your IP does not have to be within the CIDR range of the VPC no. — Ermiya Eskandary, Oct 15 '21 at 20:09
@ErmiyaEskandary I still cannot connect. I added my IP address to the inbound rules for all traffic on the security group. — Aaron Mednick, Oct 15 '21 at 20:12
Let us [continue this discussion in chat](https://chat.stackoverflow.com/rooms/238187/discussion-between-aaron-mednick-and-ermiya-eskandary). — Aaron Mednick, Oct 15 '21 at 20:24

score 7 · Accepted Answer · answered Oct 16 '21 at 06:43

I figured it out.

Apparently, you cannot access elasticache clusters from outside AWS by default. In order to do this, you need to create a VPN through AWS and connect to that in order to reach your desired cluster.

The steps to do this are outlined in this AWS tutorial here, but in more simple terms all I did was the following:

Create and import a certificate of authority using the AWS Certificate Manager. You will use this certificate to authorize your VPN connection.
Create a VPN Client Endpoint and attach the key and certificate generated in the previous step with it.
Associate the VPC being used on your elasticache cluster with the VPN endpoint.
Authorize all traffic on your VPN for all users.
Add a route to the route table of your VPN endpoint to allow access from anywhere (0.0.0.0/0).
Download VPN client configuration file locally and connect to the VPN using "openvpn" (you may need to brew install this) with your certificate and key created in the first step.

This worked for me and I'm glad I figured it out. Now I can connect to my Redis cluster from my local machine using "redis-cli"!

score 1 · Answer 2 · answered Jul 02 '22 at 16:39

1

you can also do this via a jump server / bastion host and even local port forwarding.

answered Jul 02 '22 at 16:39

Devqxz

51
1
6

score 0 · Answer 3 · answered Jun 30 '23 at 05:45

0

Probably you need to edit the Inbound rule in Network&Security of the Redis cluster. Also if you are using VPN, please ensure if you have made a TCP protocol entry.

answered Jun 30 '23 at 05:45

Sagar

41
2

Cannot Connect To AWS Elasticache Redis Cluster From Local Machine

3 Answers3