$npx -y skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-elasticacheProvides AWS CloudFormation patterns for ElastiCache Redis or Memcached infrastructure, including subnet groups, parameter groups, security controls, and cross-stack outputs. Use when designing cache tiers, high-availability replication groups, encryption settings, or reusable Cl
| 1 | # AWS CloudFormation ElastiCache |
| 2 | |
| 3 | ## Overview |
| 4 | |
| 5 | Use this skill to model ElastiCache infrastructure with CloudFormation without turning `SKILL.md` into a full service manual. |
| 6 | |
| 7 | Focus on the delivery decisions that matter most: |
| 8 | - choosing the right cache topology |
| 9 | - placing the cache safely inside a VPC |
| 10 | - configuring availability, encryption, and exports for downstream stacks |
| 11 | |
| 12 | Use the bundled `references/` documents for larger production templates and service-specific detail. |
| 13 | |
| 14 | ## When to Use |
| 15 | |
| 16 | Use this skill when: |
| 17 | - creating a Redis or Memcached cache tier with CloudFormation |
| 18 | - deciding between `AWS::ElastiCache::CacheCluster` and `AWS::ElastiCache::ReplicationGroup` |
| 19 | - configuring subnet groups, parameter groups, and security groups for application access |
| 20 | - adding snapshots, maintenance windows, encryption, and Multi-AZ behavior |
| 21 | - exporting cache endpoints to application or platform stacks |
| 22 | - reviewing cache changes for replacement risk, downtime, or operational cost |
| 23 | |
| 24 | Typical trigger phrases include `cloudformation elasticache`, `redis replication group`, `memcached cluster`, `cache subnet group`, and `export redis endpoint`. |
| 25 | |
| 26 | ## Instructions |
| 27 | |
| 28 | ### 1. Choose the cache topology first |
| 29 | |
| 30 | Use: |
| 31 | - `ReplicationGroup` for production Redis-style deployments that need failover, replicas, or sharding |
| 32 | - `CacheCluster` for Memcached or simple single-node cache scenarios |
| 33 | |
| 34 | Do not start with resource YAML before deciding whether the application needs durability, read replicas, cluster mode, or just an ephemeral cache. |
| 35 | |
| 36 | ### 2. Model the network boundary explicitly |
| 37 | |
| 38 | Create and wire: |
| 39 | - a subnet group with private application subnets |
| 40 | - a security group that allows access only from the application tier |
| 41 | - parameter groups only when default engine settings are insufficient |
| 42 | |
| 43 | Keep the cache private unless there is a very unusual and well-reviewed reason not to. |
| 44 | |
| 45 | ### 3. Configure durability and security based on environment |
| 46 | |
| 47 | For production-style Redis deployments, decide on: |
| 48 | - automatic failover and Multi-AZ |
| 49 | - at-rest and in-transit encryption |
| 50 | - snapshot retention and maintenance windows |
| 51 | - authentication or auth token strategy where supported |
| 52 | |
| 53 | For lower environments, document when a cheaper single-node configuration is acceptable. |
| 54 | |
| 55 | ### 4. Add reusable parameters and outputs |
| 56 | |
| 57 | Parameterize only the settings that truly vary between environments, such as node type, subnet IDs, or snapshot retention. |
| 58 | |
| 59 | Export outputs that other stacks need, typically: |
| 60 | - primary or configuration endpoint |
| 61 | - reader endpoint when applicable |
| 62 | - security group or subnet group identifiers only if downstream stacks genuinely depend on them |
| 63 | |
| 64 | ### 5. Validate the stack change before rollout |
| 65 | |
| 66 | Before deployment: |
| 67 | - run template validation |
| 68 | - inspect whether changes replace the cluster or replication group |
| 69 | - review security group exposure and encryption settings |
| 70 | - confirm maintenance, backup, and scaling choices match the application's recovery expectations |
| 71 | |
| 72 | ## Examples |
| 73 | |
| 74 | ### Example 1: Redis replication group with private networking |
| 75 | |
| 76 | ```yaml |
| 77 | Parameters: |
| 78 | CacheNodeType: |
| 79 | Type: String |
| 80 | Default: cache.t4g.small |
| 81 | |
| 82 | Resources: |
| 83 | CacheSubnetGroup: |
| 84 | Type: AWS::ElastiCache::SubnetGroup |
| 85 | Properties: |
| 86 | Description: Private subnets for the cache tier |
| 87 | SubnetIds: !Ref PrivateSubnetIds |
| 88 | |
| 89 | CacheSecurityGroup: |
| 90 | Type: AWS::EC2::SecurityGroup |
| 91 | Properties: |
| 92 | GroupDescription: Application access to Redis |
| 93 | VpcId: !Ref VpcId |
| 94 | |
| 95 | RedisReplicationGroup: |
| 96 | Type: AWS::ElastiCache::ReplicationGroup |
| 97 | Properties: |
| 98 | ReplicationGroupDescription: Application Redis cluster |
| 99 | Engine: redis |
| 100 | CacheNodeType: !Ref CacheNodeType |
| 101 | NumNodeGroups: 1 |
| 102 | ReplicasPerNodeGroup: 1 |
| 103 | AutomaticFailoverEnabled: true |
| 104 | MultiAZEnabled: true |
| 105 | CacheSubnetGroupName: !Ref CacheSubnetGroup |
| 106 | SecurityGroupIds: |
| 107 | - !Ref CacheSecurityGroup |
| 108 | TransitEncryptionEnabled: true |
| 109 | AtRestEncryptionEnabled: true |
| 110 | ``` |
| 111 | |
| 112 | ### Example 2: Export an endpoint for another stack |
| 113 | |
| 114 | ```yaml |
| 115 | Outputs: |
| 116 | RedisPrimaryEndpoint: |
| 117 | Description: Primary endpoint used by the application stack |
| 118 | Value: !GetAtt RedisReplicationGroup.PrimaryEndPoint.Address |
| 119 | Export: |
| 120 | Name: !Sub "${AWS::StackName}-RedisPrimaryEndpoint" |
| 121 | ``` |
| 122 | |
| 123 | Keep outputs small and stable so consumer stacks do not break unnecessarily. |
| 124 | |
| 125 | ## Best Practices |
| 126 | |
| 127 | - Prefer replication groups over single-node Redis for production systems. |
| 128 | - Put caches in private subnets and restrict ingress to known application security groups. |
| 129 | - Turn on encryption and snapshots unless there is a documented reason not to. |
| 130 | - |