1

Hello Stack Overflow community,

We're currently facing a puzzling issue related to an AWS ElasticCache (Redis) instance within our environment. We're hoping to get some insights or guidance on this matter.

The situation is as follows: We needed to temporarily halt the operation of an ElasticCache instance, but we discovered that the instance can only be terminated and not stopped. To prevent incoming traffic from reaching the ElasticCache instance, we decided to remove the associated security group and all its rules, under the assumption that this action would immediately terminate all active connections.

However, here's where it gets interesting - despite the removal of the security group and its rules, the active connections that were established prior to this change are persisting. This means that data continues to flow through these connections even though the security group, in theory, should have blocked them.

We're quite puzzled by this behavior and are struggling to understand why the removal of the security group isn't immediately cutting off all active connections. Our main goal is to effectively halt all communication with the ElasticCache instance while causing minimal disruptions to our application.

Could anyone shed some light on why these connections might still be active after the security group rules have been removed? Are there any AWS ElasticCache-specific nuances that might explain this behavior? We would greatly appreciate any insights, explanations, or suggestions on how to effectively terminate all connections to the ElasticCache instance without causing undue harm to our application.

If more details are needed, please feel free to ask, and we'll be happy to provide additional information.

AWS ElasticCache Engine: Redis Attempted Action: Removed associated security group and its rules to halt traffic Expected Outcome: Immediate termination of all active connections Current Outcome: Active connections persist despite security group removal

Devam Parikh
  • 13
  • 3

1 Answers1

0

Security groups are stateful.

This means, your security group uses connection tracking to track information about traffic to and from the instance. Rules are applied based on the connection state of the traffic to determine if the traffic is allowed or denied.

When you change a security group rule, its tracked connections are not immediately interrupted. The security group continues to allow packets until existing connections time out.

To ensure that traffic is immediately interrupted, or that all traffic is subject to firewall rules regardless of the tracking state, you can use a network ACL for your subnet. Network ACLs are stateless and therefore do not automatically allow response traffic. Adding a network ACL that blocks traffic in either direction breaks existing connections.

For more information, see Network ACLs in the Amazon VPC User Guide.

Dennis Traub
  • 50,557
  • 7
  • 93
  • 108