Connect to Amazon Web Services PrivateLink

Overview

[Amazon Web Services (AWS) PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-resources.html) allows service providers to securely expose specific services without exposing the entire service provider and consumer VPCs to each other. With AWS PrivateLink, Redis Cloud exposes a VPC endpoint service that you connect to as a consumer from your own VPC. Traffic stays within the AWS network and is isolated from external networks.

Connecting to Redis Cloud with an AWS PrivateLink is available only with Redis Cloud Pro.  It is not supported for Redis Cloud Essentials.

You can use PrivateLink as an alternative to Layer 3 connectivity options like [VPC peering]() and [Transit Gateway]().

AWS PrivateLink provides the following benefits:

- **Improved Security**: PrivateLink exposes the Redis cluster and database(s) as a unidirectional endpoint inside your consumer VPC, thereby avoiding exposing entire VPC subnets to each other and eliminating some possible attack vectors.
- **Network Flexibility**: PrivateLink enables cross-account and cross-VPC connectivity and can be configured even when the Redis Cloud VPC and your consumer VPC have overlapping CIDR/IP ranges.
- **Simplified architecture and low latency**: PrivateLink does not require NAT, internet gateways, or VPNs. It provides simplified network routing, without the need for a network load balancer between the application and the Redis database.

See [Connect to Redis Cloud with AWS PrivateLink](https://www.youtube.com/watch?v=i3aTmcyFihY) for a short video tutorial on how to connect to Redis Cloud with AWS PrivateLink.

Limitations

Be aware of the following limitations when using PrivateLink with Redis Cloud:
- You cannot use the [OSS Cluster API]() with PrivateLink during preview.
- You cannot use Layer 3 connectivity options like VPC peering or Transit Gateway with PrivateLink during private preview.
- Redis Cloud subscriptions with AWS PrivateLink are limited to a maximum of 55 databases. [Contact support](https://redis.com/company/support/) if you need more than 55 databases in one subscription with AWS PrivateLink.
- Your subnets must have at least 16 available IP addresses for the resource endpoint.
- Some AWS regions do not support PrivateLink Resource Endpoints. See [AWS VPC Lattice Pricing](https://aws.amazon.com/vpc/lattice/pricing/) for a list of regions that support AWS PrivateLink Resource Endpoints.
- Redis Cloud's PrivateLink implementation uses PrivateLink Resource Endpoints, which is based on Amazon VPC Lattice, so the [VPC Lattice quotas](https://docs.aws.amazon.com/vpc-lattice/latest/ug/quotas.html) apply. Currently, the following availability zones are not supported with Amazon VPC Lattice:
    - `use1-az3`
    - `usw1-az2`
    - `apne1-az3`
    - `apne2-az2`
    - `euc1-az2`
    - `euw1-az4`
    - `cac1-az3`
    - `ilc1-az2`

    We recommend avoiding these availability zones when creating your Redis Cloud database if you plan to use AWS PrivateLink.
- Redis Cloud [Bring your Own Cloud]() subscriptions are not supported with PrivateLink.
- The pre-handoff feature of [Smart client handoffs]() is not currently supported with AWS PrivateLink, but relaxed timeouts are available and enabled by default.

Prerequisites

Before you can connect to Redis Cloud with an AWS PrivateLink VPC resource endpoint, you must have:

- A [Redis Cloud Pro database]() and the **Owner** or **Manager** role for your Redis Cloud account.
- An [AWS VPC](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html) with the following:
    - A [security group](https://docs.aws.amazon.com/vpc/latest/userguide/creating-security-groups.html) that allows ingress traffic to the following ports:
        - The database port range (port 10000-19999)
        - The Redis Cloud metrics port (port 8070), if desired
    - Subnets in the same region as your Redis Cloud database.
    - Settings to allow **DNS resolution** and **DNS hostnames**. See [View and update DNS attributes for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns-updating.html) for more information.
- Permission to create and manage VPC endpoints or Service networks in AWS.
- AWS CLI version 2.32 or greater if using the AWS CLI.

Set up PrivateLink connection

To set up a connection to Redis Cloud with an AWS PrivateLink VPC resource endpoint, you need to:

1. [Associate the Redis Cloud Resource share with one or more AWS principals](#associate-resource-share).
1. [Add a connection](#add-connection) from your consumer account using a VPC resource endpoint or a VPC Lattice service network.

Associate Redis Cloud resource share with a principal {#associate-resource-share}

In this step, you will associate the Redis Cloud resource share with an AWS principal, such as an AWS Account.

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.

1. Select **Connectivity > PrivateLink** to view the PrivateLink settings.

1. In the **Resource Share** section, select **Manage Principals** to open the **Manage Principals** window.

1. Select the **Add** button in the **AWS consumer principals** section to add a principal to the resource share.

1. Select the type of principal you want to add from the **Principal type** list. You can choose from the following principal types:

    - AWS account
    - [Organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html)
    - [Organizational unit (OU)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_ous.html)
    - [Identity and Access Management (IAM) role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)
    - [IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html)
    - Service principal

1. Enter the principal's ID in the **Principal ID** field. You can also add an optional alias in the **AWS principal alias** field.

1. Select **Share** to share the resource share with the principal. The first resource share may take a few minutes.

1. After sharing the resource share with the principal, [accept the resource share in the Resource Access Manager](https://docs.aws.amazon.com/ram/latest/userguide/working-with-shared-invitations.html) or copy the **Accept resource share** command and run it with the AWS CLI.

After you accept the resource share, the Redis Cloud console will show the principal as **Accepted**.

You can add additional principals to the resource share at any time.

Add a connection {#add-connection}

In this step, you will add a connection from your consumer account using a VPC resource endpoint or a VPC lattice service network.

From the **Connectivity > PrivateLink** tab in your Redis Cloud subscription, open the **Add connection** section.

Here, choose whether you want to connect to Redis using a **Resource endpoint** or a **Service network**.

**Resource endpoint:**

You can connect with a VPC resource endpoint through the AWS Console or with the AWS CLI.

#### AWS Console

Follow the guide to [create a VPC resource endpoint in the AWS console](https://docs.aws.amazon.com/vpc/latest/privatelink/use-resource-endpoint.html#create-resource-endpoint-aws) with the following settings:

- **Type**: Select **Resources**.
- **Resource configurations**: Select the configuration with the same Resource Configuration ID as the one shown in the Redis Cloud console.
- **VPC**: Select your VPC from the list.
- **Additional settings**: Select **Enable private DNS name** and set **Private DNS Preference** to **Verified domains only** or **Verified domains and specified domains**.
- **Subnets**: Select the subnets to create endpoint network resources in.
- **Security groups**: Select any security groups you want to associate with the resource endpoint, including the security group that allows access to the necessary ports, as described in the [prerequisites](#prerequisites)

#### AWS CLI

To use the AWS CLI to add a VPC resource endpoint, select **Copy** under the **AWS CLI Command** to save the command to your clipboard. Enter the saved command in a terminal shell to create the resource endpoint and replace the following parameters with your own values:

- `<vpc id>`: The ID of your VPC
- `<subnet ids>`: The IDs of the subnets to create endpoint network resources in
- `<security group ids>`: The IDs of any security groups you want to associate with the resource endpoint, including the security group that allows access to the necessary ports, as described in the [prerequisites](#prerequisites)

**Service network:**

You can connect with an existing [VPC lattice service network](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-networks.html) through the AWS Console or with the AWS CLI.

#### AWS Console

Follow the guide to [Manage resource configuration associations](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-network-associations.html#service-network-resource-config-association) for your service network. Select the configuration with the same Resource Configuration ID as the one shown in the Redis Cloud console.

#### AWS CLI

To use the AWS CLI to connect to an already existing service network, select **Copy** under the **AWS CLI Command** to save the command to your clipboard. Enter the saved command in a terminal shell to connect to the service network and replace `<service network id>` with the ID of your service network.

Connect to your database and metrics endpoint with PrivateLink

After you've connected to Redis Cloud with a VPC resource endpoint or a VPC lattice service network, you can find the endpoints for your databases and cluster metrics in the AWS UI by going to the **Associations** tab for your endpoint or service network and viewing the Private DNS entries. You will have one entry for each database and one entry for the metrics endpoint.

To view them on Redis Cloud, download the **Discovery script** from the Redis Cloud console and run it in your consumer VPC to discover the database endpoints.

The script returns a list of database endpoints that you can connect to from your consumer VPC.

[code example]

You can connect to your database by using the database `private-dns-entry` and `port` from your consumer VPC. You can also connect to the metrics endpoint with services like [Prometheus and Grafana]() by using the metrics `private-dns-entry` and `port`.

After you've connected to your database, you can view the connection details in the Redis Cloud console in your subscription's **Connectivity > PrivateLink** tab or by going to the [connection wizard]() for your database. The private endpoint will point to the PrivateLink VPC resource endpoint or service network that you created.

Disassociate connection

To disassociate a PrivateLink connection:

1. Go to the **Connectivity > PrivateLink** tab in your Redis Cloud subscription.

1. In the **Connections** section, select **Disassociate** button next to the connection you want to disassociate.

1. Select **Disassociate VPC endpoint** or **Disassociate service network** to confirm.

After disassociating the connection, you can delete the VPC resource endpoint or service network in the AWS console.


Connect to Amazon Web Services Transit Gateway

Overview

[Amazon Web Services (AWS) Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html) acts as a Regional virtual router for traffic flowing between your virtual private cloud(s) (VPCs) and on-premises networks. You can attach different resources to your Transit Gateway which include:

- One or more VPCs
- One or more virtual private network (VPN) connections
- One or more AWS Direct Connect gateways
- One or more Transit Gateway Connect attachments
- One or more transit gateway peering connections

You can connect your Redis Cloud Pro subscription to a Transit Gateway which is attached to the VPC of your application. This lets your application connect securely to your Redis Cloud database while optimizing performance.

Transit Gateway is available only with Redis Cloud Pro.  It is not supported for Redis Cloud Essentials.

Considerations

You can use Transit Gateway as an alternative to [VPC peering](), or you can enable both for your subscription.

Compared to VPC peering, Transit Gateway:

- Supports complex network topologies, such as multiple VPCs or site-to-site VPNs.

- Uses security groups and network ACLs to control traffic between VPCs.

- Has a higher network latency and cost than VPC peering due to Transit Gateway infrastructure costs.

Consider using VPC peering and Transit Gateway in parallel for the following situations:

- When migrating from one connectivity solution to the other.

- If different applications need to connect to the same database but have different latency or security requirements.

Prerequisites

Before you can set up Transit Gateway, you need to:

1. [Create a database with Redis Cloud Pro]() from the [Redis Cloud console](https://cloud.redis.io/#/).

1. [Create a transit gateway](https://docs.aws.amazon.com/vpc/latest/tgw/create-tgw.html) from the [AWS VPC console](https://console.aws.amazon.com/vpc/) in the same region as your database.

If you use Redis Cloud Bring your own Cloud, you will need to set its IAM Instance Policy to include Transit Gateway. See [Create IAM resources using the AWS console]() for more information.

AWS Transit Gateway

To set up Transit Gateway:

1. [Associate your resource share with the Redis AWS account](#associate-resource-share).

1. [Accept the resource share and create an attachment](#accept-resource-share).

1. [Add consumer CIDRs](#add-consumer-cidrs) to the attachment.

1. [Update AWS route tables](#update-route-tables) with the Redis Cloud producer CIDRs.

Associate resource share with Redis Cloud {#associate-resource-share}

In this step, you will associate your resource share with your subscription's AWS account. You can do this either in the [AWS console](#aws-console) or with the [AWS CLI](#aws-cli).

#### AWS Console

To use the AWS console to set up the resource share:

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.

1. Select **Connectivity > Transit Gateway** to view the transit gateway settings.

1. In the **Share Transit Gateway** section, select **Copy** under **AWS console** to copy the Redis AWS Account number.

1. If you don't have a resource share for your transit gateway, follow the guide to [create a resource share](https://docs.aws.amazon.com/ram/latest/userguide/working-with-sharing-create.html) in the [AWS resource access manager](https://console.aws.amazon.com/ram/home). If you do, follow the guide to [update](https://docs.aws.amazon.com/ram/latest/userguide/working-with-sharing-update.html) the resource share to include the provided AWS account as an Allowed Principal.

    During the **Grant access to principals** step, select **AWS Account** in the **Select principal type** field. Enter the copied AWS account number in the **Enter an AWS Account ID** field.

    After the principal is added, it may take some time before it is associated. You can see the status of the principals under **Shared Principals** in the resource share page.

#### AWS CLI

To use the AWS CLI to set up the resource share:

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.

1. Select **Connectivity > Transit Gateway** to view the transit gateway settings.

1. In the **Share Transit Gateway** section, select **Copy** under **AWS CLI Command** to copy the Redis AWS Account number.

1. Enter the copied CLI command into a terminal shell. Replace `<TGW ARN>` with the Amazon resource name of your transit gateway.

Accept resource share and create attachment {#accept-resource-share}

After you've associated the Redis AWS account with your resource share, you must accept the resource share in the Redis Cloud console.

1. In your Redis Cloud subscription's Transit Gateway settings, you should now see that a **Resource Share** is available. Select **Resource Shares** to view the resource share you initiated.

1. Select **Accept** to associate the **Resource Share** with your Redis Cloud console account.

1. Select **Close** to close the **Accept resource shares** section.

1. You will now see your transit gateway in the **Transit Gateways** section. After the **TGW status** is **Available**, select **Create Attachment** under **Attachment status**.

    This will request a peering attachment representing Redis's AWS account to the Transit Gateway.

1. If your transit gateway does not automatically accept peering attachment requests, the attachment will be in **Pending acceptance** status. Follow the guide to [Accept a peering attachment request](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-peering.html#tgw-peering-accept-reject) from the [AWS VPC console](https://console.aws.amazon.com/vpc/).

Add consumer CIDRs

1. In your Redis Cloud subscription's Transit Gateway settings, in the **Transit Gateways** section, select **Add CIDRs** under **Consumer CIDRs**.

1. Enter the IPv4 CIDR of the VPC you want to connect to that is also connected to your transit gateway. To find this, go to the [AWS VPC console](https://console.aws.amazon.com/vpc/) and select **Your VPCs**.

    Select **Add** to add another CIDR if needed.

    Select **Save** to save your changes.

Update AWS route tables {#update-route-tables}

To finish Transit gateway setup, [update your route tables for the peering connection](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-routing.html) with the following details:

1. In the **Destination** field, enter the producer deployment CIDRs.

    You can find the producer deployment CIDRs on the Redis Cloud console in the Transit Gateway settings by selecting **More actions > View Attachment** in the **Transit Gateway** section.

1. In the **Target** field, select **Transit Gateway** and select the relevant **Transit gateway ID**.

After Transit gateway is established, we recommend switching your application connection string to the private endpoint.

If you've enabled the database's [CIDR allow list](), you must also [add the Transit Gateway's IP address to the CIDR allow list]() to connect to the database via the private endpoint.

Continue learning with Redis University


Configure CIDR allow list

Summary: The CIDR allow list permits traffic between a range of IP addresses and the Redis Cloud VPC.

Overview

The [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) [allow list](https://en.wikipedia.org/wiki/Whitelist) lets you restrict traffic to your Redis Cloud database. When you configure an allow list, only the [IP addresses](https://en.wikipedia.org/wiki/IP_address) defined in the list can connect to the database. Traffic from all other IP addresses is blocked.

To use the CIDR allow list, you must be on either paid Redis Cloud Essentials or on Redis Cloud Pro.  This feature is not supported on free Redis Cloud Essentials plans.

Define CIDR allow list

To define the CIDR allow list for a database:

1. Select **Databases** from the [Redis Cloud console](https://cloud.redis.io/) menu and then select your database from the list.

1. From the database's **Configuration** screen, select the **Edit database** button.

1. In the **Security** section, turn on the **CIDR allow list** toggle.

1. Enter the first IP address (in CIDR format) you want to allow in the text box and then select the check mark to add it to the allow list:

1. To allow additional IP addresses:

    1. Select **Add CIDR**.

    1. Enter the new IP address in the text box and then select check to add it to the allow list.

    The number of CIDR allow list entries that you can add is based on your Redis Cloud plan. Redis Cloud Essentials plans can have between 4 and 32 entries depending on the plan. Redis Cloud Pro plans can have up to 32 entries.

1. Select **Save database** to apply your changes.

The database CIDR allow list applies to both the public endpoint and the private endpoint. If you use connectivity options such as [VPC Peering]() and [Transit Gateway]() to connect to your database via the private endpoint, you must also add those IPs to your database's CIDR allow list.

Continue learning with Redis University


Block public endpoints

Summary: Learn how to block the public endpoints of your databases.

Overview

By default, you can connect to Redis Cloud databases through the database's public endpoint, or through the database's private endpoint with a private connectivity method.

Public endpoints are accessible from the public internet and don't require a private connectivity method. While this makes Redis Cloud databases convenient to use, it also exposes the databases to potential unauthorized access or brute force attacks, even with a database password in place. Some organizations may want to block public access to their databases to comply with security policies or to better meet stringent compliance standards.

Users with Redis Cloud Pro databases can choose to block public endpoints for all databases in their subscription.

After you block your database's public endpoint, any connection from an IP address that is not part of the private address space defined in [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918#section-3) will be rejected. Ensure that all connections to your database are made through a private connectivity method before blocking the public endpoint.

Block public endpoints

You can block public endpoints for a [new subscription](#new-subscription) or an [existing subscription](#existing-subscription).

New subscription

To block the public endpoints when you [create a new Pro subscription]():

1. Follow the instructions to [create a Pro database with custom settings]().
1. On the **Setup** tab, go to **Advanced options > Security** to select persistent storage encryption options.
1. Select **Block public endpoint** to block the public endpoint for all databases on the subscription.
1. Select **Continue** to go to the [Sizing tab](). Follow the instructions to provision your database(s).

After you block the public endpoints for a new subscription, you will need to set up a [private connectivity method](#private-connectivity-methods) to connect to your databases.

Existing subscription

For existing subscriptions, we recommend setting up a [private connectivity method](#private-connectivity-methods) to connect to your databases before blocking the private endpoint and migrating all connections to the private endpoint.

To block the public endpoints of an existing Pro subscription:

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.
1. Open the **Security** tab to view security settings.
1. In the **Endpoint** section, select **Edit**.
1. Select **Block public endpoint**.
1. Select **Save** to save your changes.
1. A window will appear asking you to confirm that blocking the public endpoint will reject clients connecting to the public endpoint. Select **I understand** and then **Block** to confirm.

After your changes are saved, any incoming connections to the public endpoint of your database will be rejected, and only connections through a private connectivity method will be allowed.

Turn on passwordless authentication for the default user

If you have blocked the public endpoint for your Redis Cloud Pro subscription, you can turn on passwordless authentication for the [default user]() for any database in that subscription.

To turn on passwordless authentication:

1. From the database **Configuration** tab, select **Edit**.
1. In the **Security** section, select **Use passwordless auth** to turn on passwordless authentication.

1. Select **Save database** to save your changes.

Private connectivity methods

Redis Cloud supports the following private connectivity options:
- [VPC peering]()
- [Google Cloud Private Service Connect]() _(Google Cloud only)_
- [AWS Transit Gateway]() or [AWS PrivateLink]() _(AWS only)_


Cloud database security

Summary: Enable TLS to encrypt data communications between applications and Redis databases.

Transport Layer Security (TLS)

Network security

Block public endpoints

Overview

Redis Cloud provides several features to help you secure your databases. These include
[password-based authentication]() and [role-based access control](),
[network security](), [TLS](), and [encryption-at-rest]().

Passwords, users, and roles

All Redis Cloud databases [require a password]() to connect. However, we recommend enabling [role-based access control]() (RBAC) for additional security. With RBAC, you can define
all the roles you need, with the appropriate permissions, and assign those roles
to your users.

Network security

Redis Cloud supports two types of network security: [IP Restrictions](#ip) and [VPCs](#virtual-private-clouds). We recommend that you employ at least one of these network security options to constrain access to your databases.

Transport Layer Security (TLS)

Redis Cloud supports [Transport Layer Security]() (TLS) for database access. TLS, often called "SSL", ensures the privacy of the TCP connection between your application and database. When client
authentication is activated, TLS ensures that only clients with an authorized key can access to your Redis databases.

We strongly recommend enabling TLS for any application transmitting sensitive data across the wire.

Disk encryption

Redis Cloud provides encryption for all data stored on disk in Redis databases. See our [encryption at rest documentation]() for specific details.

Continue learning with Redis University


Network security

Overview

Redis Cloud supports two types of network security: database-level CIDR allow lists and [VPC](#virtual-private-clouds)-wide CIDR allow lists.

These features are available in most Redis Cloud configurations, as shown here:

| Cloud provider | VPC peering | IP restrictions |
|:-------------------:|-------------|-----------------|
| AWS | Redis Cloud Pro | Paid Redis Cloud Essentials and Redis Cloud Pro |
| Google Cloud | Redis Cloud Pro | Paid Redis Cloud Essentials and Redis Cloud Pro |
| Azure | Redis Cloud Pro | Redis Cloud Pro |

IP and subnet restrictions {#ip}

You can restrict database access to a configurable
set of source IP addresses and subnets. This is roughly equivalent
to using [iptables](https://en.wikipedia.org/wiki/Iptables) to limit access to a host.

To restrict a database to a specific set of source IP addresses or subnets, see [Configure CIDR allow list]().

Virtual private clouds

A [Virtual Private Cloud](https://en.wikipedia.org/wiki/Virtual_private_cloud) (VPC) is an isolated set of resources within a [public cloud](https://en.wikipedia.org/wiki/Cloud_computing#Public_cloud), usually having its own subnets and VLAN.

Redis Cloud Pro databases are almost always deployed in a Redis VPC. In most cases, you'll need to create a [VPC peering connection]() to access these databases. A VPC peering connection allows unrestricted network access between two VPCs.

Connection creation and supported features vary by public cloud provider. Learn more about VPC usage for [AWS](#vpcs-with-aws), [Google Cloud](#vpcs-with-google-cloud), and [Azure](#vpcs-with-azure).

VPCs with AWS

Subscriptions that run on AWS support two VPC options. To ensure that that you can securely connect to your database, you need to [create a VPC peering connection]().

If you create a VPC peering connection, you can also [configure a CIDR allow list]() to allow connections only from specific IP address blocks or security groups.

VPCs with Google Cloud

Subscriptions that run on Google Cloud *require* a VPC peering connection. See [Google Cloud VPC peering]() to learn how to set up VPC peering for Google Cloud.

VPCs with Azure

When you request a Redis Cloud Annual subscription, all databases will be deployed in your own Azure VPC.


Transport Layer Security (TLS)

Overview

Transport Layer Security (TLS) uses encryption to secure [network communications](https://en.wikipedia.org/wiki/Transport_Layer_Security).

Paid Redis Cloud Essentials plans and Redis Cloud Pro plans can use TLS to encrypt data communications between applications and Redis databases.

TLS is not available for Free Redis Cloud Essentials plans.

TLS recommendations

TLS is not enabled by default.

Because TLS has an impact on performance, you need to determine whether the security benefits of TLS are worth the performance impact. TLS recommendations depend on the subscription plan and whether clients connect to your database using public or private endpoints.

This table shows TLS recommendations:

| Subscription | Public endpoint | Private endpoint |
|--------------|----------------------|------------|
| Redis Cloud Essentials        | Enable TLS           | N/A |
| Redis Cloud Pro     | Enable TLS           | Enable TLS if security outweighs performance impact |

Client authentication

When you enable TLS, you can optionally require client authentication (also known as "mutual authentication"). If enabled, all clients must present a valid client certificate when they connect to the database.

Client authentication is not required by Redis Cloud; however, it is strongly recommended.

Enable TLS

To enable TLS for a Redis Cloud database:

1. Select **Databases** from the [Redis Cloud console](https://cloud.redis.io/) menu and then select your database from the list.

1. From the database's **Configuration** screen, select **Edit**:

1. In the **Security** section, use the **Transport layer security (TLS)** toggle to enable TLS:

1. Select the **Download server certificate** button to download the Redis Cloud certificate bundle `redis_ca.pem`:

1. Decide whether you want to require client authentication:

    - If you only want clients that present a valid certificate to be able to connect, continue to the next step.

    - If you do not want to require client authentication, skip to the final step to apply your changes.

1. To require client authentication, select the **Mutual TLS (require client authentication)** checkbox.

1. Select **Add client certificate** to add a certificate.

1. Either provide an [X.509 client certificate](https://en.wikipedia.org/wiki/X.509) or chain in PEM format for your client or select **Generate** to create one:

    - If you generate your certificate from the Redis Cloud console, a **Download certificate** button will appear after it is generated. Select it to download the certificate.

        The download contains:

        - `redis-db-<database_id>.crt` – the certificate's public key.

        - `redis-db-<database_id>.key` – the certificate's private key.

You must download the certificate using the button at this point.  After your changes have been applied, the full bundle of public and private keys will no longer be available for download.

    - If you provide a client certificate or a certificate chain, you will see the certificate details before you save your changes.

    Select **Save** to save the client certificate.

1. You can select **Add client certificate** again to add another certificate.

1. To apply your changes and enable TLS, select the **Save database** button:

- When you enable or turn off TLS, the change applies to new connections but does not affect existing connections. Clients must close existing connections and reconnect to apply the change.

- Once you've enabled TLS, all client connections to your database must use TLS. Unencrypted connections will no longer be permitted.

Connect over TLS

To connect to a Redis Cloud database over TLS, you need:

* A Redis client that supports TLS
* Redis Cloud CA certificates

Download CA certificates {#download-certificates}

If you don't have the Redis Cloud CA certificates, you can download them from the Redis Cloud console:

1. Either select **Account Settings** from the Redis Cloud console menu or go to the database's **Configuration** screen.

1. Go to the **Security** section.

1. For **Redis Cloud certificate authority**, either:

    - Select the **Download** button to download the certificates from **Redis Cloud certificate authority** in **Account Settings**:

    - Select the **Download server certificate** button to download the certificates from the database's **Configuration** screen:

The download contains a file called `redis_ca.pem`, which includes the following certificates:

- Self-signed Redis Cloud Essentials plan Root CA (deprecated but still in use)

- Self-signed Redis Cloud Pro plan Root CA and intermediate CA (deprecated but still in use)

- Publicly trusted GlobalSign Root CA

The downloaded PEM file contains multiple certificates. Make sure to import **all** certificates to your client trust store. If your client code is not implemented properly, it may only import the first certificate.

To inspect the certificates in `redis_ca.pem`, run the `keytool` command:

[code example]

You can add `redis_ca.pem` to the trust store or pass it directly to a Redis client.

If your database requires client authentication, you also need the public (`redis_user.crt`) and private (`redis_user_private.key`) client keys. See
[Enable TLS](#enable-tls) for details.

Connect with the Redis CLI

Here's how to use the [Redis CLI]() to connect to a TLS-enabled Redis Cloud database.

Endpoint and port details are available from the **Databases** list or the database's **Configuration** screen.

#### Without client authentication

If your database doesn't require client authentication, then provide the Redis Cloud CA certificate bundle (`redis_ca.pem`) when you connect:

[code example]

#### With client authentication

If your database requires client authentication, then you also need to provide your client's private and public keys:

[code example]

keytool -printcert -file ./redis_ca.pem | grep "Owner:"

redis-cli -h <endpoint> -p <port> --tls --cacert redis_ca.pem \
    --cert redis_user.crt --key redis_user_private.key


Encryption at rest

Summary: Describes when data is encrypted at rest.

Overview

Redis Cloud databases write their data to disk whenever [persistence]() is enabled.

Redis Cloud deployments are always encrypted at rest.

Encryption at rest on AWS {#aws}

Persistent data is written to encrypted EBS volumes. For more information, see [Amazon EBS encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html).

When Auto Tiering is enabled, the flash memory data is written to encrypted NVMe SSD volumes. For more information, see [SSD instance store volumes](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ssd-instance-store.html).

Disk encryption on Google Cloud {#gcp}

All data written to disk on Google Cloud-based Redis Cloud deployments is encrypted by default. When deploying
a Redis Cloud database on Google Cloud, you don't need to take any actions to enable this encryption.

To learn more, see the [Google Cloud Default encryption at rest](https://cloud.google.com/security/encryption-at-rest).

Disk encryption on Azure {#azure}

All data written to disk on Azure-based Redis Cloud deployments is encrypted by default. When deploying
a Redis Cloud database on Azure, you don't need to take any actions to enable this encryption.

To learn more, see the [Azure Data Encryption at rest](https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest).

Continue learning with Redis University


Security

Summary: Control who can access the Redis Cloud console and databases.

Access control

Redis Cloud shared responsibility model

Cloud database security

Configure CIDR allow list

Encryption at rest

Summary: Private Service Connect creates a private endpoint that allows secure connections to Redis Cloud databases without exposing your application VPC.

Enable Google Cloud Private Service Connect

Summary: VPC peering uses private IP addresses to route traffic between a Redis Cloud VPC and an application VPC.

Enable VPC peering

Overview

Redis Cloud provides a number of ways to secure subscriptions and databases.

As a Redis Cloud user, consider these security domains:

- The [Redis Cloud console](#admin-console-security)
- [Your databases]()
- The [Redis Cloud API]()

First, you might want to review our [shared responsibility model]() for security.

Redis Cloud console security {#admin-console-security}

The Redis Cloud console is the web application you use to manage your Redis Cloud deployments.

Secure access to the Redis Cloud console by:

- Assigning appropriate roles to [team members with access]().

- Enabling [multi-factor authentication]().

- Enabling [SAML SSO]().

A user session on Redis Cloud expires after 30 minutes. You'll be signed out of Redis Cloud after 30 minutes of inactivity.

Database security

You have several options when it comes to securing your Redis Cloud databases. For more information, see [Cloud database security](). Options include:

- [Encryption at rest]()
- [Role-based access control]()
- [TLS]()
- [Network security]() using
- [VPC peering]() and [CIDR whitelist]()

API security

The Redis Cloud API allows you to programmatically administer your subscriptions and database deployments. This API is disabled by default. When you [enable the API](), you can then [manage the API keys]() for all owners of your Redis Cloud account. For an overview of the security features of the API, see the [API authentication documentation]().

Continue learning with Redis University


Overview

[Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect) (PSC) creates a private endpoint that allows secure connections to Redis Cloud databases without exposing your application's [virtual private cloud](https://en.wikipedia.org/wiki/Virtual_private_cloud) (VPC).

This feature is only available for Redis Cloud Pro subscriptions hosted on Google Cloud.

Considerations

You can use Private Service Connect as an alternative to [VPC peering](), or you can enable both for your subscription.

Compared to VPC peering, Private Service Connect:

- Only exposes the private endpoint instead of the entire application VPC network.

- Allows producer (Redis Cloud VPC) and consumer (application VPC) CIDR ranges to overlap.

- Has slightly higher network latency than VPC peering due to load balancing requirements.

Larger clusters are more likely to experience increased latency with Private Service Connect versus VPC peering.

Consider using VPC peering and Private Service Connect in parallel for the following situations:

- When migrating from one connectivity solution to the other.

- If different applications need to connect to the same database but have different latency or security requirements.

Set up Private Service Connect {#setup-psc}

To set up Private Service Connect, you need to:

1. [Configure Private Service Connect](#configure-psc) in the Redis Cloud console.

1. [Create Private Service Connect endpoints](#create-endpoints) in the application VPC.

1. From the Redis Cloud console, review and [accept the Private Service Connect endpoint connection](#accept-psc).

Configure PSC {#configure-psc}

First, configure Private Service Connect in Redis Cloud:

1. Select **Subscriptions** from the [Redis Cloud console](https://cloud.redis.io/) menu and then select your subscription from the list.

2. Select the **Connectivity** tab and then **Private Service Connect**.

3. Select the **Create connection** button:

4. Read the **Latency and cost impact** message and select **Accept and continue**:

5. For **Create connection**, enter the following **Endpoint details**:

    | Setting name | Description |
    |-------------------|-------------|
    | _Google Cloud project ID_ | Google Cloud project ID |
    | _VPC name_ | Name of the VPC that hosts your application |
    | _Subnet name_ | Name of your VPC's subnet of IP address ranges |
    | _Endpoint name_ | Prefix used to create PSC endpoints in the consumer application VPC, so endpoint names appear in Google Cloud as _endpoint name prefix + endpoint number_ |

6. Continue to the **Add connections** step:

7. Select either **Bash Shell** or **PowerShell** and then download or copy the provided `gcloud` script for later:

8. Select **Continue** to save this endpoint configuration:

Create endpoints {#create-endpoints}

Now that you have a pending Private Service Connect entry, you need to create the endpoints in your application's VPC:

1. If you have not already done so, [enable Cloud DNS](https://cloud.google.com/dns/docs/set-up-dns-records-domain-name) for your Google Cloud project.

Since it can take some time for the DNS changes to become active, we recommend you wait 10 minutes before running the `gcloud` script in the next steps.

1. If you already have a copy of the `gcloud` script shown earlier during the **Add connections** step, you can continue to the next step.

    1. Otherwise, return to your Redis Cloud subscription's **Connectivity > Private Service Connect** screen and select **Complete setup** for the pending endpoint:

    1. Download or copy the script.

1. Use the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud) to run the script.

To ensure the `gcloud` script configures the endpoints correctly, do not make any changes to it.

The `gcloud` script creates a PSC endpoint and a DNS response policy in the consumer application VPC.

Accept PSC connection {#accept-psc}

After the `gcloud` script finishes creating the Private Service Connect endpoint, you need to accept the connection in Redis Cloud:

1. In the Redis Cloud console, return to your subscription's **Connectivity > Private Service Connect** screen.

1. Find your pending endpoint connection in the list and select **Accept**:

Connect to database {#connect-db}

Once your Private Service Connect endpoint is active, you can connect your application to a database:

1. From your subscription's **Connectivity > Private Service Connect** tab, select the **Connect** button for the active endpoint:

1. Select a database from the list.

1. Copy the endpoint and use it in your application to connect to your database.

Once your Private Service Connect endpoint is active, you must connect to the database from the Private Service Connect endpoint if you want to connect with Private Service connect. If you previously used the public or private endpoint to connect to your database, you must migrate any connections to the Private Service Connect endpoint.

Deactivate Private Service Connect {#deactivate-psc}

To deactivate Private Service Connect for your subscription:

1. Select **Subscriptions** from the [Redis Cloud console](https://cloud.redis.io/) menu and then select your subscription from the list.

1. Select the **Connectivity** tab and then **Private Service Connect**.

1. For each endpoint:

    1. Select the **Delete PSC endpoint** button:

    1. Copy the provided `gcloud` script from the **Remove endpoint** dialog.

    1. Run the `gcloud` script with [`gcloud` CLI](https://cloud.google.com/sdk/gcloud) to delete the endpoint and DNS response policy.

1. After you remove all endpoints, select the **Actions** button to see a list of available actions:

1. Select **Remove service** and then **Confirm**:

Once you remove all of your Private Service Connect endpoints and deactivate it, you must migrate any connections from a Private Service Connect endpoint to the public or private endpoint of your database.

Limitations

Private Service Connect has the following limitations in Redis Cloud:

- Although Redis Cloud supports using Private Service Connect with Enterprise clustering, you cannot use the [Cluster API]() with Private Service Connect enabled.
- The pre-handoff feature of [Smart client handoffs]() is not currently supported with Private Service Connect, but relaxed timeouts are available and enabled by default.

Continue learning with Redis University


Redis Cloud shared responsibility model

Overview

The security of all Redis Cloud deployments is a shared responsibility. Redis, the public cloud providers (Amazon Web Services [AWS], Google Cloud, and Microsoft Azure), and our customers all help ensure the security of these deployments.

Redis responsibility

Redis Cloud's offerings are managed by Redis and deployed on AWS, Azure, and Google Cloud infrastructure.

Redis is responsible for the software that runs Redis Cloud. This includes the patching and maintenance of
the operating systems that Redis is deployed on as well as the patching and maintenance of Redis Cloud.

Cloud provider responsibility

The public cloud provider hosting your Redis Cloud databases is responsible for the physical security of their data centers and
the security of the network, storage, servers, and virtualization that form the core infrastructure of your deployment.

Amazon, Microsoft, and Google public clouds embrace a wide range of security best practices and compliance standards. Compliance information—including audits, attestations, and certifications about resources hosted—can be found on these compliance pages:

* [AWS Compliance](https://aws.amazon.com/compliance/)
* [Google Cloud Compliance](https://cloud.google.com/security/compliance)
* [Azure Compliance](https://azure.microsoft.com/en-us/overview/trusted-cloud/compliance/)

Customer responsibility

Customers are responsible for the security configurations in their Redis databases and the Redis Cloud console. Customers must understand and implement the Redis Cloud security features and best practices.

Customers are also responsible for the applications built on Redis and the data they store in Redis. Customers determine the cloud provider, region, and availability zone of their deployments.

Customers understand that Redis Cloud Essentials plans are deployed to a multi-tenant infrastructure. Redis Cloud Pro plans are deployed to a single-tenant infrastructure dedicated to one specific customer.

Continue learning with Redis University


Enable VPC peering

Overview

VPC peering uses private IP addresses to allow network connections between two [virtual private clouds](https://en.wikipedia.org/wiki/Virtual_private_cloud) (VPCs).

You can connect your VPC in the Redis Cloud subscription to the VPC of your application. This lets your application connect securely to your Redis Cloud database using VPC peering to optimize the performance of your application.

VPC peering is available only with Redis Cloud Pro.  It is not supported for Redis Cloud Essentials.

VPC peering configuration requires you to initiate VPC peering on your Redis Cloud subscription and then accept the VPC peering request for the AWS VPC that you want to peer with.

AWS VPC peering

If you want to peer a Redis Cloud VPC with an AWS VPC, you need to:

1. [Configure and initiate VPC peering](#config-aws-vpc-peering) for your Redis Cloud subscription.

1. [Approve the VPC peering request](#approve-aws-vpc-peering).

1. [Update the routes tables](#update-route-tables).

Configure VPC peering {#config-aws-vpc-peering}

To set up VPC peering:

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.

1. Select **Connectivity > VPC Peering**.

1. Select **Add peering**.

1. Enter **VPC peering** details:

    | Setting | Description |
    |-------------------|-------------|
    | _Consumer AWS Account_ | Your AWS account ID (see [Finding your AWS account ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html#FindingYourAWSId)) |
    | _Consumer region_ | AWS VPC region |
    | _Consumer VPC ID_ | The VPC ID for the application that needs to access your Redis Cloud VPC (see [Finding a VPC ID](https://docs.aws.amazon.com/managedservices/latest/userguide/find-vpc.html)) |
    | _Consumer VPC CIDRs_ | [CIDR-formatted](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) IP addresses for the AWS VPC that needs to access your Redis Cloud VPC; must not overlap with the _Redis producer VPC CIDR_ (see [View your VPCs](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-vpcs.html#view-vpc)) |

1. You can provide up to five VPC CIDRs.

    To add multiple VPC CIDRs:

    1. Select **Add CIDR**.
    1. Enter additional CIDR-formatted IP address in the box:

1. Select **Initiate peering**.
1. Note the **Peering ID** of the VPC peering request.

Approve VPC peering request {#approve-aws-vpc-peering}

After you set up and intitiate VPC peering, you need to approve the VPC peering request:

1. Follow the AWS guide to [accept the VPC peering connection](https://docs.aws.amazon.com/vpc/latest/peering/accept-vpc-peering-connection.html).

1. After you accept the peering request, select **Modify my route tables now**. This button can be found in the green header once the peering connection is **active**.

Update route tables {#update-route-tables}

To finish VPC peering setup, [update your route tables for the peering connection](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-routing.html). There may be many different route tables assigned to different VPCs. It is important to choose the route table assigned to the VPC you specified in the [Configure VPC Peering](#config-aws-vpc-peering) section with the following details:

1. In the **Destination** field, enter the Redis Cloud VPC CIDR shown when you accepted the peering request.

    This is the Redis Cloud VPC CIDR address, to which your application's VPC connects.

1. In the **Target** field, select **Peering Connection** and select the relevant **Peering ID**.

Once VPC peering is established, we recommend switching your application connection string to the private endpoint.

Google Cloud VPC peering {#gcp-vpc-peering}

If you want to peer a Redis Cloud VPC with a Google Cloud VPC, you need to:

1. [Configure and initiate VPC peering](#config-gcp-vpc-peering) for your Redis Cloud subscription.

1. [Approve the VPC peering request](#approve-gcp-vpc-peering).

Configure VPC peering {#config-gcp-vpc-peering}

To set up VPC peering:

1. Select **Subscriptions** from the [Redis Cloud console](https://cloud.redis.io/) menu and then select your subscription from the list.

1. Select **Connectivity > VPC Peering**.

1. Select **Add peering**.

1. Enter the VPC peering details:

    | Setting name | Description |
    |-------------------|-------------|
    | **Project ID** | Google Cloud project ID (see [Identifying projects](https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects)) |
    | **Network name** | Google Cloud VPC network you want to peer with (see [View networks](https://cloud.google.com/vpc/docs/create-modify-vpc-networks#viewing-networks)) |

1. Copy the **Google cloud command** after you enter the other VPC peering settings. You need this command to accept the peering request later:

1. Select **Initiate peering**.
1. Note the **Cloud peering ID** of the VPC peering request.

Approve VPC peering request {#approve-gcp-vpc-peering}

To approve the VPC peering request between Redis Cloud and Google Cloud, use the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud) to run the **Google cloud command** that you copied before you initiated VPC peering.

Once VPC peering is established, we recommend switching your application connection string to the private endpoint.

Continue learning with Redis University


Create and edit Cloud accounts

Overview

Redis Cloud Bring your own Cloud (BYOC) lets you use your own cloud infrastructure to deploy Redis Cloud.

You can associate your existing AWS account as a _cloud account_ for your subscription.  This requires setting up and entering credentials that enable monitoring, maintenance, and technical support of your subscription.

To do this, you need:

1. A programmatic user with an access key and a secret access key for that user.
1. A console role that allows administrative access to the cloud account.

You need to create these resources before adding the cloud account to your subscription.  To learn more, see [Create IAM resources]().

After an AWS account has been configured as a cloud account, you **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]() for more details.

View cloud account settings

To create or edit a cloud account in Redis Cloud:

1. Sign in to the [Redis Cloud console](https://cloud.redis.io/) and then select the target subscription.

1. From the console menu, select **Account Settings** and then select the **BYOC Accounts** tab.

    This displays a list of cloud accounts associated with your Redis Cloud subscription.

The **Cloud account** tab lets you manage cloud accounts associated with your Redis Cloud subscription.

The **Cloud Account** tab is only available for accounts with Redis Cloud Bring your own Cloud (BYOC) subscriptions.

Add a new cloud account

To add a new cloud account to your Redis Cloud subscription, select the **Add** button from the **BYOC Accounts** tab of the Account Settings screen.

This displays the **Bring your own Cloud (BYOC)** dialog.

Each of the following fields are required.

|Setting|Description|
|-------|-----------|
| _Account name_ | A descriptive name for your cloud account settings |
| _AWS access key_ | The AWS access key for the programmatic user created to support your cloud account settings |
| _AWS secret key_ | The AWS secret key for the programmatic user created to support your cloud account settings |
| _IAM role name_ | The name of the AWS console role with access to the AWS console |

Use the **Add account** button to save your cloud account details.

Be sure to create the resources before adding the cloud account to your subscription, as they're used to verify access to the cloud account.  The details can be saved only after access is verified.

When problems occur, an information icon appears and the field is highlighted in red.  When this happens, the icon includes a tooltip that explains the issue.

If the **Add account** button is inactive, verify that:

- You've specified all field values correctly
- The resources exist in your AWS account
- Each resource provides the required level of access

For help, see [Create IAM resources]().

Edit cloud account details

To update the details of a cloud account associated with your Redis Cloud subscription, select the cloud account from the **Cloud account** tab and then select the **Edit** button.

This displays the **Edit cloud account** dialog:

|Setting|Description|
|-------|-----------|
| _Account name_ | A descriptive name for your cloud account settings |
| _AWS access key_ | The AWS access key for the programmatic user created to support your cloud account settings |
| _AWS secret key_ | The AWS secret key for the programmatic user created to support your cloud account settings |
| _IAM role name_ | The name of the AWS console role with access to the AWS console |

Use the **Update account** button to save your changes.

Delete cloud account

To remove a cloud account from your Redis cloud subscription, select the cloud account from the **Cloud account** tab and then select the **Delete** button.

Dedicated IAM resources

We strongly recommend using dedicated identity and access management (IAM) resources to manage your AWS cloud accounts.  These resources should not be shared with any other task, account, or process.

To learn more, see [Create IAM resources for AWS cloud accounts]().


Create IAM resources using AWS console

Overview

Follow these steps to manually create IAM resources using the [AWS console](https://console.aws.amazon.com/).

We use the provided credentials to configure your AWS environment and provision required resources.

You **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]() for more details.

Step 1: Create the IAM instance policy

The IAM instance policy controls the permissions for the instances that Redis Cloud creates in your AWS account.

Follow the steps to [create an IAM policy using the JSON editor](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html#access_policies_create-json-editor) with the following settings:

- In **Specify permissions**, select **JSON**, and then enter the contents of the RedisLabsInstanceRolePolicy.json policy file:

- In **Review and Create**, enter `RedisLabsInstanceRolePolicy` in the **Policy name** field.

Select **Create policy** to finish policy creation.

Step 2: Create the service role

After creating the instance role policy, you must create a role to assign the policy.

Follow the steps to [create a role for an AWS service](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html#roles-creatingrole-service-console) with the following settings:

- In **Select trusted entity**:
    - **Trusted entity**: Select **AWS service**.
    - **Service or use case**: Select **EC2**.
    - **Use case**: Select **EC2**.
- In **Add permissions**, select the **RedisLabsInstanceRolePolicy** you created.
- In **Name, review, and create**, enter `redislabs-cluster-node-role` in the **Role name** field.

Select **Create role** to finish role creation.

Step 3: Create the user policy

The user policy controls the permissions for the user that Redis Cloud uses to manage your AWS account.

Follow the steps to [create an IAM policy using the JSON editor](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html#access_policies_create-json-editor) with the following settings:

- In **Specify permissions**, select **JSON**, and then enter the contents of the RedisLabsIAMUserRestrictedPolicy.json policy file:

- In **Review and Create**, enter `RedislabsIAMUserRestrictedPolicy` in the **Policy name** field.

Select **Create policy** to finish policy creation.

Step 4: Create the programmatic access user

After you create the user policy, you must create a programmatic access user and attach the policy to it.

Follow the steps to [create a user on the AWS console](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html), with the following settings:

- In **Specify user details**, For **User name**, enter `redislabs-user`.
- In **Set permissions**:
    - **Permissions options**: Select **Attach existing policies directly**.
    - **Permissions policies**: Select the **RedislabsIAMUserRestrictedPolicy** you created from the list.

Select **Create user** to create the user.

After you create the user, you need to add an access key for the user.

Follow the steps to [create an access key](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-keys-admin-managed.html#admin-create-access-key) for the user you just created. Save the access key ID and secret access key in a secure location.

Step 5: Create the console access role

The console access role controls the permissions for the user that Redis Cloud uses to access the AWS console.

Follow the steps to [Create a role for an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) with the following settings:

- In **Select trusted entity**:
    - **Trusted entity**: Select **AWS account**.
    - **An AWS account**: Select **Another AWS account**.
    - **Account ID**: Enter account number `168085023892` (Redis Cloud's AWS account).
    - **Options**: Select **Require MFA**.

Do not check the **Require external ID** checkbox.

- In **Add permissions**, select the **RedislabsIAMUserRestrictedPolicy** you created.
- In **Name, review, and create**, enter `redislabs-role` in the **Role name** field.

Select **Create role** to finish role creation. Save the Role name for later.

Next steps

When you've finished creating all of the resources, you can [create a Cloud Account]() in the Redis Cloud console. To do this, you'll need the following information:

- **Access Key ID**: The Access Key ID for the [programmatic user you created](#step-4-create-the-programmatic-access-user).
- **Secret Access Key**: The Secret Access Key for the [programmatic user you created](#step-4-create-the-programmatic-access-user).
- **IAM Role Name**: The name of the [console access role you created](#step-5-create-the-console-access-role).


Create IAM resources using CloudFormation

Overview

You can use [AWS CloudFormation](https://aws.amazon.com/cloudformation/) to create the IAM resources for Redis Cloud Bring your Own Cloud (BYOC).

We use the provided credentials to configure your AWS environment and provision required resources.

You **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]() for more details.

Create resources using CloudFormation on the AWS Console

The following link uses CloudFormation to create a stack using the AWS console:

When the stack finishes, select the stack and then the **Outputs** tab. You need the following information to [create a Cloud Account]() in the Redis Cloud console:

- **Access Key ID**: The `accessKeyId` output.
- **Secret Access Key**: Follow the link to AWS Secrets Manager in the `accessSecretKey` output and select **Retrieve secret value**.
- **IAM Role Name**: The `IAMRoleName` output.

Create resources using CloudFormation through AWS CLI

You can also use the AWS command-line interface (CLI) to create the stack:

[code example]

You can track the status of the cloud formation with the following command:

[code example]

After the stack finishes, you can retrieve the outputs from the `Outputs` section of the response.

You need the following information to [create a Cloud Account]() in the Redis Cloud console:

- **Access Key ID**: The `accessKeyId` output.
- **Secret Access Key**: Extract the secret ID from the `accessSecretKey` output. The secret ID is the `name` query parameter in the `accessSecretKey` output.

    For example, if the `accessSecretKey` output is `https://console.aws.amazon.com/secretsmanager/home?region=<region>/secret?name=/redislabsuser/secret_access_key`, then the secret ID is `/redislabsuser/secret_access_key`.

    Use the secret ID to retrieve the secret value using the AWS secretsmanager CLI:

    [code example]
    Replace `<accessSecretKey-ID>` with the secret ID you extracted from the `accessSecretKey` output.
- **IAM Role Name**: The `IAMRoleName` output.

aws cloudformation create-stack --stack-name RedisCloud --template-url \
https://s3.amazonaws.com/iam-resource-automation-do-not-delete/RedisCloud.yaml \
--capabilities CAPABILITY_AUTO_EXPAND CAPABILITY_NAMED_IAM CAPABILITY_IAM

aws cloudformation describe-stacks --stack-name RedisCloud

aws secretsmanager get-secret-value --secret-id=<accessSecretKey-ID>


Create IAM resources for AWS cloud accounts

Create IAM resources using AWS console

Create IAM resources using Terraform

Content

For Redis Cloud Bring your Own Cloud (BYOC) on Amazon Web Services (AWS), we manage the supporting infrastructure for you in dedicated AWS accounts.

You can manage this infrastructure with your own AWS accounts.

You'll want these accounts to be separate from any AWS application accounts
and you'll need to create dedicated [identity and access management](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) (IAM) resources to allow us to manage the infrastructure.

In the new AWS account, you need to create:

- An **instance role**
- A user with an **access key**
- A role that grants **AWS console access**

Save the access key in a secure location so that you can enter it when you [register the cloud account]() with your Redis Cloud subscription.

We use the provided credentials to configure your AWS environment and provision required resources.

You **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]() for more details.

For help creating an AWS user, see the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).

You can use one of the following tools to create IAM resources:

- [CloudFormation]()
- [Terraform]()
- The [AWS Console]()


Create IAM resources using Terraform

Content

You can use [HashiCorp Terraform](https://www.terraform.io/intro/index.html) to create identity and access management (IAM) resources to support AWS cloud account access to Redis Cloud subscriptions.

We use the provided credentials to configure your AWS environment and provision required resources.

You **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]() for more details.

The following example uses the `terraform-aws-Redislabs-Cloud-Account-IAM-Resources` module, located in Amazon S3:

1. Copy the following code into a file called `main.tf`.

    Replace the following values in the `main.tf` file:

    - `<profile>`: The AWS CLI profile to use.
    - `<region>`: The AWS region to use.
    - `<pgp_key>`: The PGP key to use. For details, see the [Terraform docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_login_profile#pgp_key).

2. Initialize Terraform with the module:

    Note: Terraform requires [AWS credentials be supplied](https://www.terraform.io/docs/language/modules/sources.html#s3-bucket), but the source of the module is a public S3 bucket, so any valid credentials should work.

    [code example]

    Replace `<access_key_id>` and `<secret_key>` with valid AWS keys.

3. Build the resources and display the outputs:

    [code example]

    You need the following information to [create a Cloud Account]() in the Redis Cloud console:

    - **Access Key ID**: The `accessKeyId` output.
    - **Secret Access Key**: Run the following command to extract the secret key from the `accessSecretKey` output:
        [code example]
    - **IAM Role Name**: The `IAMRoleName` output.

AWS_ACCESS_KEY_ID=<access_key_id> AWS_SECRET_KEY=<secret_key> terraform init

echo $(terraform output -raw accessSecretKey)


Redis Cloud Bring your own Cloud

Summary: Describes how to provision your Redis Cloud subscription to use an existing cloud provider account.

Create and edit Cloud accounts

Configure subscription CIDR allow list

Overview

Redis Cloud Bring your own Cloud (BYOC) allows organizations to use their own cloud infrastructure to deploy Redis Cloud.

By default, Redis hosts the infrastructure that runs Redis Cloud. However, if your organization has specific requirements, you may need to have more control over your data residency or security options. Redis Cloud BYOC lets you fulfill these requirements while still having a fully managed service experience of Redis Cloud. Like standard Redis Cloud, Redis manages deployment, scaling, monitoring, and support, so you can focus on building applications while Redis manages the backend.

Redis Cloud BYOC availability requires approval from Redis. If you're interested, [contact sales](https://redis.io/meeting/).

Benefits of Redis Cloud BYOC

Redis Cloud BYOC has some benefits over standard Redis Cloud:

- **Full Data Control**: All data stays within your environment, giving you complete control over data security and reducing risks associated with data sovereignty.
- **Simplified Compliance**: BYOC simplifies adherence to regulatory standards like GDPR, HIPAA, and compliance frameworks like SOC 2 and PCI DSS since data remains within your own cloud account.
- **Maximize Cloud Commitments**: Infrastructure costs are billed directly through your cloud provider account, enabling you to fully utilize existing commitments.
- **Separation of Costs**: Customers pay Redis only for licensing and management, while infrastructure costs go directly to the cloud provider, offering clear visibility into each cost stream.
- **Instant Access Control**: You can revoke Redis’ access to your environment at any time, offering complete control over data and infrastructure.

Redis Cloud BYOC Use cases

Consider using Redis Cloud BYOC if you have specific organizational needs or requirements, such as:

- **Data Residency and Compliance**: Organizations operating in heavily regulated industries (such as finance, healthcare, and government) can use Redis Cloud BYOC to meet strict data residency and sovereignty requirements, ensuring sensitive data remains within their controlled environments.
- **Cloud spend optimization**: Companies with significant cloud provider commitments can use Redis Cloud BYOC to optimize their cloud spend. Since infrastructure costs are billed directly through the cloud provider, customers can fully utilize existing cloud provider discounts, improving cost efficiency.
- **Enhanced Security and Control**: Redis Cloud BYOC is ideal for organizations that require a higher degree of security and control over their data. By keeping data within your own cloud account, you can use existing security policies, tools, and procedures in your cloud’s security infrastructure. In this way, you can minimize external access to your data, and adhere to more strict organizational security guidelines.

Set up Redis Cloud BYOC

To set up Redis Cloud BYOC on Amazon Web Services (AWS):

1. [Create the Identity and Access Management (IAM) resources]() needed to let Redis create, monitor, and maintain deployment infrastructure.

1. [Set your AWS Account as a BYOC Cloud account]() on Redis Cloud.

After you set up your cloud account, you can create a [new Redis Cloud Pro subscription]() or an [Active-Active database]() that uses your cloud account.

Redis Cloud BYOC pricing

With Redis Cloud BYOC, you pay for the Redis Cloud service, including database management, monitoring, and support.  You also pay for the underlying cloud infrastructure, including virtual machines, storage, and networking, directly to your cloud provider.

When you create a database, you'll see the costs for the Redis Cloud service, but not the costs for the underlying cloud infrastructure. You can view and manage those costs in your cloud provider account.

Avoid Redis Cloud BYOC service disruption {#avoid-service-disruption}

Failing to follow the instructions in this section will cause your databases to become inaccessible, and Redis will not be able to ensure cluster and database stability. Please read them carefully.

To keep your Redis Cloud BYOC service and all databases running without issues:
- Do not stop, delete, or modify Redis-managed resources through the cloud provider - including VPCs, subnets, virtual machines, and other infrastructure.
- Do not change roles or access policies.

If you make any infrastructure changes, whether or not they are listed above, it may violate our SLA commitments. See [Appendix 1 in our Terms of Service](https://redis.io/legal/cloud-tos/#Appendix-1) for more details.


Configure subscription CIDR allow list

Overview

The [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) [allow list](https://en.wikipedia.org/wiki/Whitelist) lets you restrict traffic to your Redis Cloud database. When you configure an allow list, only the [IP addresses](https://en.wikipedia.org/wiki/IP_address) defined in the list can connect to the database. Traffic from all other IP addresses is blocked.

If you use [Redis Cloud Bring your Own Cloud]() to host your Redis Cloud deployment, you can configure a subscription-wide allow list
to restrict traffic to all databases associated with the subscription.

The subscription CIDR allow list defines a range of IP addresses and [AWS security groups](https://docs.aws.amazon.com/managedservices/latest/userguide/about-security-groups.html) that control inbound and outbound traffic to the Redis Cloud [VPC](https://en.wikipedia.org/wiki/Virtual_private_cloud). When you add security groups to the allow list, you can also use the same security groups to manage access to your application.

The subscription-level allow list is available for Redis Cloud Bring your Own Cloud. If you don't have Redis Cloud Bring your Own Cloud, you can configure a [CIDR allow list]() for each database.

Allow IP address or security group

To add IP addresses or [AWS security groups](https://docs.aws.amazon.com/managedservices/latest/userguide/about-security-groups.html) to a subscription's allow list:

1. From the [Redis Cloud console](https://cloud.redis.io/) menu, select **Subscriptions** and then select your subscription from the list.

1. Select **Connectivity > Allow List**.

1. If the allow list is empty, select **Add allow list**.

1. Select an entry **Type** from the list:

1. In the **Value** box, enter one of these options:

    - An IP address in CIDR format

    - The AWS security group ID

1. Select the check to add the entry to the allow list.

1. To allow additional IP addresses or security groups:

    1. Select **Add** to add a new entry.

    1. Select the new entry's **Type**, enter the **Value**, and select the check to add it to the allow list.

    You can also select the **Edit** button to change an entry or the **Delete** button to remove it.

1. Select **Apply all changes** to apply the allow list updates.


Delete a subscription

Content

Once a subscription is deleted, it cannot be recovered. We recommend [backing up your data]() before removing databases or subscriptions.

To delete a subscription:

1.  [Delete all databases]() from the subscription.

    The number of databases for the subscription is shown in the subscription list. You cannot delete a subscription until there are zero databases in the subscription.

2.  View the subscription details.

    If you have more than one subscription, select the target subscription from the subscription list.

3.  Select the **Overview** tab.

4.  Select the **Delete subscription** button.

5.  Select the **Delete subscription** button to confirm your choice.


Manage subscriptions

View and Upgrade Redis Cloud Essentials plan

View and edit Redis Cloud Pro plan

Summary: Upgrade your Redis Cloud Essentials subscription to a Redis Cloud Pro subscription.

Upgrade database from Redis Cloud Essentials to Redis Cloud Pro

Delete a subscription

Redis Cloud Bring your own Cloud

Summary: Describes maintenance that Redis performs on a Redis Cloud subscription.

Subscription and database maintenance

Overview

This page helps you manage your Redis Cloud subscriptions; it briefly compares available plans and shows where to find help with common tasks.

Subscription plans

As of April 2024, Redis Cloud supports the following subscription plans:

- [Free Redis Cloud Essentials](#free-rce)
- [Paid Redis Cloud Essentials](#paid-rce)
- [Essentials with Redis Flex](#redis-flex)
- [Redis Cloud Pro](#redis-cloud-pro)

Here's a quick comparison of each plan:

| Feature | Redis Cloud Essentials (free) | Redis Cloud Essentials (paid) | Essentials with Redis Flex | Redis Cloud Pro |
|:---:|:---:|:---:|:---:|:---:|
| Memory size | 30 MB | 250 MB-12 GB | 1 GB-100GB | 50 TB |
| Concurrent connections | 30 | 256-10000 | 1024-10000 | Unlimited |
| Security | Role-based auth
Password protection
Encryption in transit | Role-based auth
Password protection
TLS auth
Encryption in transit | Role-based auth
Password protection
TLS auth
Encryption in transit | Role-based auth
Password protection
TLS auth
Encryption in transit
Encryption at rest
Private Connectivity |
| REST API | No | Yes | Yes | Yes |
| Selected additional features

 |  | Replication
Auto-failover
 | Replication
Auto-failover
 | Dedicated accounts
Redis Flex
Active/Active
 |

To learn more, see [Redis Cloud Pricing](https://redis.io/pricing/).

Free Redis Cloud Essentials {#free-rce}

Free plans are a type of Redis Cloud Essentials plans designed for training purposes and prototyping. They can be seamlessly upgraded to other Redis Cloud Essentials plans with no data loss.

Paid Redis Cloud Essentials {#paid-rce}

Redis Cloud Essentials is cost-efficient and designed for low-throughput scenarios. It support a range of availability, persistence, and backup options.  Pricing supports low throughput workloads. See [Redis Cloud Essentials plans]() for a list of available plans.

- [View and upgrade Essentials or Flex plan]()

#### Essentials with Redis Flex {#redis-flex}

You can select Redis Cloud Essentials plans that support a tiered solid state drive (SSD) and RAM architecture. Using SSDs instead of RAM significantly reduces infrastructure costs, which means developers can build applications that require large datasets using the same Redis API.

Redis Flex is ideal when your:

- working set is significantly smaller than your dataset (high RAM hit rate)
- average key size is smaller than average value size (all key names are stored in RAM)
- most recent data is the most frequently used (high RAM hit rate)

See [Create a Redis Flex database]() to learn more about Redis Flex, and see [Redis Flex plans]() for a list of available plans.

- [View and upgrade Essentials or Flex plan]()

Redis Cloud Pro

Redis Cloud Pro supports more databases, larger databases, greater throughput, and unlimited connections compared to Redis Cloud Essentials. Hosted in dedicated VPCs, they feature high-availability in a single or multi-AZ, Active-Active, clustering, data persistence, and configurable backups.  Pricing is "pay as you go" to support any dataset size or throughput. [Redis Flex]() is also available on Redis Cloud Pro.

Redis Cloud Pro annual plans support the same features as Redis Cloud Pro but at significant savings. Annual plans also provide Premium support. The underlying commitment applies to all workloads across multiple providers and regions.

- [View and edit Pro subscription]()
- [Upgrade from Essentials to Pro]()
- [Subscription maintenance]()


Subscription and database maintenance

Summary: Shows how to set manual maintenance windows and skip maintenance.

Set maintenance windows

Overview

Redis will maintain your Redis Cloud subscriptions and databases as needed to ensure your databases are running the most stable and up-to-date version of Redis.

Maintenance windows

Maintenance windows define when Redis can perform maintenance on your subscriptions and databases. Maintenance window options depend on your subscription type.

Redis Cloud Pro

For Redis Cloud Pro plans, Redis will perform maintenance automatically while limiting service disruption as much as possible. If you want to control when we can perform maintenance for a Redis Cloud Pro subscription, you can [set manual maintenance windows]().

Redis Cloud Essentials

Redis Cloud Essentials databases have a set maintenance window based on the cloud provider region. The maintenance window for Redis Cloud Essentials databases is **daily from 12 AM to 6 AM** in the region's local time zone. We won't use more than one maintenance window per week unless we need to do [urgent maintenance](), and we won't perform any maintenance that introduces breaking changes during these maintenance windows.

Maintenance activities

During maintenance, Redis ensures the stability of your subscriptions and databases.

This includes, but is not limited to:

- Upgrading Redis or an advanced capability to the latest version
- Cluster optimization
- Replacing a cluster node
- Adding more memory to a node
- Applying security patches

Redis will notify users by email when maintenance starts and ends. For more details, see [Notifications](#notifications).

During maintenance, your database will be operational, but you may notice some latency when connecting to your databases.

Your application may also disconnect from your database for a few seconds. Most Redis clients are set to refresh their DNS address when they reconnect to the database, and you will not be required to perform any further action. If you encounter connectivity problems for more than a minute during maintenance, please refresh your DNS entries.

To make sure your applications are set to reconnect after maintenance activity, see [Develop highly available and resilient apps with Redis Cloud]().

Urgent maintenance

Urgent maintenance refers to any activity that could affect service and cannot wait for scheduling. This includes applying urgent security patches.

Redis can perform urgent maintenance at any time, even if you have set a manual maintenance window or have temporarily [skipped maintenance](). Redis will notify you by email when urgent maintenance starts and ends.

Major upgrades

We won't schedule major upgrades or upgrades that might include breaking changes until you opt-in to those changes. You can control your Redis major version on the [subscription page]().

Notifications

Redis will notify you by email when maintenance starts and ends. If Redis needs an action from you to start maintenance, we will notify you with a reasonable amount of time before planned maintenance.

If you want to receive advance maintenance notifications, you must [set manual maintenance windows]() and [contact support](https://redis.io/support/) to request advance maintenance notifications.

To receive maintenance notifications by email:

1. Go to [Access Management]() and select your account in the list.

1. Select the Edit button.

1. Select **Operational emails** if it is not already turned on.

1. Select **Save user** to save your changes.


Set maintenance windows

Overview

By default, Redis will maintain your Redis Cloud subscriptions and databases as needed. During maintenance, you may notice some latency when connecting to your databases. For more information about the types of maintenance and how Redis maintains your subscriptions, see [Maintenance]().

For Redis Cloud Pro plans, Redis will perform maintenance automatically while limiting service disruption as much as possible. If you want to control when Redis performs maintenance for a Redis Cloud Pro subscription, you can [set manual maintenance windows](#set-manual-maintenance-windows) to ensure non-urgent maintenance will occur at set times. Configuring or altering the maintenance window will not have any impact on your subscription or databases.

You can only set manual maintenance windows for Redis Cloud Pro plans. A Redis Cloud Essentials database has a set maintenance window based on the region where it is located. See [Essentials maintenance]() for more information.

Set manual maintenance windows

To set manual maintenance windows for a single Redis Cloud Pro subscription:

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.

1. Select the **Overview** tab.

1. In the **Maintenance Windows** panel, select **Manual**.

1. Click **Activate** to confirm your selection.

1. Enter the maintenance window time frame details.

    - Select the days that Redis can perform maintenance in the **Days** drop-down.
    - Select the time that Redis can start performing maintenance on those days in the **From** drop-down.
    - Select the amount of time that Redis can perform maintenance in the **Duration** drop-down.
    - Select **+ Time Frame** to add another time frame for maintenance.
    - Select **Advance notification** if you want to be notified of maintenance in advance.

You must [contact support](https://redis.io/support/) to request and be approved for advance maintenance notifications, otherwise skip this step as the this option does not appear by default.

    Redis recommends allowing maintenance on at least two different days for 8 hours on each day.

1. Click **Save**.

Skip maintenance temporarily

To skip maintenance temporarily for a subscription:

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.

1. Select the **Overview** tab.

1. In the **Maintenance Windows** panel, select **Skip the next 14 days**.

1. Click **Continue** to confirm your selection.

You will only be allowed to skip maintenance once per month.

During the skipped maintenance period, Redis will not perform any minor or major upgrades. Redis may perform [urgent maintenance]() on your subscription, but only if it is absolutely necessary.


Overview

Redis Cloud Essentials supports low throughput workflows. It supports a range of availability, persistence, and backup options, and can be great for testing and prototyping. However, if your databases need higher throughput, or you're missing features that are not available with Redis Cloud Essentials, you may want to upgrade Redis Cloud Essentials to Redis Cloud Pro.

For more information about the different subscription plans, see [Subscription plans]().

To upgrade your Essentials plan, see [Upgrade subscription plan]().

Upgrade Essentials subscription to Pro

To follow the steps in this guide, you must have a database with [Redis Cloud Essentials]() that you want to upgrade to Redis Cloud Pro.

To upgrade your Essentials database to Redis Cloud Pro:

1. [Create a new database in Redis Cloud Pro](#create-rcp) with the right specifications to be able to migrate your database.

1. [Migrate your Essentials database](#migrate-database) to your new Redis Cloud Pro database.

Create Redis Cloud Pro database {#create-rcp}

[Create a new database]() with the following specifications:

- Select **Redis Cloud Pro** for your subscription type.
- Select the **Version** that matches the Redis version your Essentials subscriptions use.
- In the [**Sizing tab**](), create your databases with the following specifications:
    - Set the memory limit to comply with [Active-Passive memory requirements]() if you want to migrate your database using [Active-Passive]().
    - Select any advanced capabilities that your Essentials database offers. You can find a list of enabled advanced capabilities in the [Configuration tab]() of your database.

Migrate database

You can migrate your Redis Cloud Essentials database to your new Redis Cloud Pro subscription using any method in the [Migrate databases]() guide. This guide uses [Active-Passive]() to migrate databases between subscriptions in the same account.

Before you follow this guide, be aware of the following limitations:

- This guide is for migrating databases between subscriptions in the same Redis Cloud console account. [Contact support](https://redis.io/support/) if you want to migrate a database between accounts using Active-Passive.

- As long as Active-Passive is enabled, data in the target database will not expire and will not be evicted regardless of the set [data eviction policy](). We recommend that you turn off Active-Passive after the databases are synced.

1. Select the database you want to migrate your data to. This will be your target database.

1. From the **Configuration** tab of the target database, select **Edit**.

1. In the **Durability** section, enable **Active-Passive Redis** and then select **Add Source**.

1. This will open the **Add Active-Passive Redis** screen. Select **Current account** to connect a database in your current account.

1. Select your Redis Cloud Essentials database from the **Source database** list. This will be your source database. You can type in the database's name to find it.

1. Select **Save Database** to begin updating the database.

    Initially, the database status is __Pending__, which means the update task is still running.

    The sync process doesn't begin until the database becomes `Active`.

    When data has fully migrated to the target database, database status reports `Synced`.

    Active-Passive sync lets you migrate data while apps and other connections are using the source database. Once the data is migrated, you should migrate active connections to the target database before you move on.

1. After your data and connections are migrated, turn off **Active-Passive Redis** from the target database.

1. [Delete the source database]().


Redis Cloud Essentials plans

Summary: Provides detailed information on Redis Cloud Essentials plans.

Overview

Redis Cloud Essentials is cost-efficient and designed for low-throughput scenarios. It supports a range of availability, persistence, and backup options.

[Essentials plan pricing](https://redis.io/pricing/#monthly) scales according to the memory size of the database defined in the subscription.  Additional limits also apply, as shown in the tables below.

The 30 MB Essentials plan is free; it's designed for learning and building test projects. It gives you enough space to learn Redis concepts and develop application prototypes.

Our paid plans start at 250 MB and offer extra features, like high availability and backups (both daily and instant). They are great for bigger projects or production environments that require increased storage, reliability, and other features to support your operational needs.

Essentials plans have bandwidth and throughput limits described in the tables below. We will notify you before limiting your database usage if you exceed these limits.

If you need additional resources, you can [upgrade your subscription]() at any time.

Current plans

These plans are currently offered for all new and upgraded Essentials subscriptions (updated December 2025).

Redis Cloud Essentials plans

| **DB size**[1](#table-note-1) | **30 MB (Free)** | **250 MB** | **1 GB** | **2.5 GB** | **5 GB** | **12 GB** |
|---|---|---|---|---|---|---|
| **Concurrent
connections
per database** | 30 | 256 | 1024 | 2500 | 5000 | 10000 |
| **CIDR
 allow rules** | 1 | 4 | 4-8 | 4-8 | 4-16 | 4-32 |
| **Monthly
 total network
 bandwidth[2](#table-note-2)** | 5 GB | 100 GB | 200 GB | 400 GB | 800 GB | 2000 GB |
| **Maximum
 throughput[3](#table-note-3)** | 100 ops/sec | 1000 ops/sec | 2000 ops/sec | 4000 ops/sec | 8000 ops/sec | 16000 ops/sec |

1.  Database size includes replication where applicable. See [High availability cost impact]() for more information.

2.  The monthly total network bandwidth limit applies to the entire plan. All databases in the plan share the allocated bandwidth limit.

3.  Assumes request size of 1 KiB. Maximums are capped by actual MB/s reached. To find the MB/s limit, divide the Maximum throughput by 1024.

Redis Cloud Essentials plans with Redis Flex

| **DB size**[1](#table-note-1-flex) | **1 GB** | **2.5 GB** | **5 GB** | **12 GB** | **25 GB** | **50 GB** | **100 GB** |
|---|---|---|---|---|---|---|---|
| **Concurrent
connections
per database** | 1024 | 2500 | 5000 | 10000 | 10000 | 10000 | 10000 |
| **CIDR
 allow rules** | 4-8 | 4-8 | 4-16 | 4-32 | 4-32 | 4-32 | 4-32 |
| **Monthly
 total network
 bandwidth** | 50 GB | 100 GB | 200 GB | 500 GB | 1000 GB | 2000 GB | 4000 GB |
| **Maximum
 throughput[2](#table-note-2-flex)** | 200 ops/sec | 500 ops/sec | 1000 ops/sec | 2400 ops/sec | 5000 ops/sec | 10000 ops/sec | 20000 ops/sec |

1.  Database size includes replication where applicable. See [High availability cost impact]() for more information.

2.  Assumes request size of 1 KiB. Maximums are capped by actual MB/s reached. To find the MB/s limit, divide the Maximum throughput by 1024.

Previous plans {#legacy}

These plans were available before November 2023.

| **Max DB size **[1](#table-note-1-legacy)               | **30 MB**        | **100 MB**       | **250 MB**        | **500 MB**        | **1 GB**          | **2.5 GB**        | **5 GB**          | **10 GB**          |
|-----------------------------------------------------------------------------------|------------------|------------------|-------------------|-------------------|-------------------|-------------------|-------------------|--------------------|
| **Concurrent
connections
per database**                                   | 30               | 256              | 256               | 512               | 1024              | 2500              | 5000              | 10000              |
| **Monthly
 total network
 bandwidth**[2](#table-note-2-legacy) | 5 GB        | 50 GB       | 100 GB       | 150 GB       | 200 GB       | 400 GB       | 800 GB       | 2000 GB       |
| **Maximum
 throughput[3](#table-note-3-legacy)**                                                       | 100 ops/sec | 500 ops/sec | 1000 ops/sec | 1500 ops/sec | 2000 ops/sec | 4000 ops/sec | 8000 ops/sec | 16000 ops/sec |

1.  Database size includes replication. See [High availability cost impact]() for more information.

2.  The monthly total network bandwidth limit applies to the entire plan. All databases in the plan share the allocated bandwidth limit.

2.  Assumes request size of 1 KiB. Maximums are capped by actual MB/s reached. To find the MB/s limit, divide the Maximum throughput by 1024.


Redis Cloud Essentials plans

Overview

To view the details of a Redis Cloud Essentials subscription:

1.  Sign in to the [Redis Cloud console](https://cloud.redis.io/) and select the **Subscriptions** list.

1.  Select the target subscription from the subscription list.

1.  Your subscription details appear, along with a summary of your database details.

From here, you can:

- Select the **Plan upgrade** button to update your subscription plan, high availability settings, or payment method.

- Select the **Overview** tab to view and edit subscription details.

The following sections provide more details.

Upgrade plan

Use the **Plan upgrade** button to update your Redis Cloud Essentials plan, your high availability settings, or your payment method. Upgrading your database between Redis Cloud Essentials plans does not impact database availability during the update.

For information on how to upgrade to Redis Cloud Pro, see [upgrade subscription plan from Essentials to Pro]().

Change high availability and persistence

To change your plan's [high availability]() and [data persistence]() settings, change them in the **Configure your settings** panel.

You can switch between **No replication** and **Single-zone replication** at any time, but you cannot choose **Multi-zone replication** after your subscription is created. You also cannot switch from **Multi-zone replication** to another high availability option.

Change subscription plan

To change your subscription plan, select the desired plan from the list and select the **Upgrade plan** button:

Each Redis Cloud Essentials plan provides a variety of benefits, including increased memory and number of connections.
For a comparison of available plans, see [Redis Cloud Essentials plans]().

When you change your plan, your data and endpoints are not disrupted.

If you upgrade a free plan to a paid plan, you need to add a payment method.

If you change your subscription to a lower plan, make sure your data fits within the limits of the new plan; otherwise, the change attempt will fail.

Change payment method

To change your subscription payment method, update the **Payment method** settings.  You can select a known payment method from the drop-down list or use the **Add** button to add a new one.

Payment method changes require the Owner or Billing Admin roles. To verify your role, select **Access Management** from the admin menu and then locate your credentials in the **Team** tab.

Save changes

Use the **Update Database** button to save changes.

Subscription overview

The **Overview** tab summarizes your Redis Cloud Essentials subscription details using a series of panels:

The following details are displayed:

| Detail | Description |
|:---------|:--------------|
| **Subscription description** | Brief summary of subscription, including the plan type, cloud provider, region, and data size limit |
| **Cloud vendor** | Your database's cloud vendor |
| **Availability** | Describes high availability settings |
| **Region** | The region your subscription is deployed to |
| **Plan** | The maximum database size of your Essentials plan. Also displays the cost for paid plans. |
| **Databases** | Maximum number of databases for your plan |
| **Connections** | Maximum number of concurrent connections |
| **CIDR allow rules** | Maximum number of authorization rules |
| **Data persistence** | Indicates whether persistence is supported for your subscription |
| **Daily & instant backups** | Indicates whether backups are supported for your subscription |
| **Replication** | Indicates whether replication is supported for your subscription |
| **Clustering** | Indicates whether clustering is supported for your subscription |

The **Delete Database** button lets you [delete your database]().