title: Okta SAML integration guide (Org2Org)

title: Overview

text:
This guide shows how to configure [Okta](https://help.okta.com/en-us/Content/Topics/Security/Identity_Providers.htm) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account.

This guide shows how to use the Org2Org application template. You can also use the [Generic]() application template.

To learn more about Redis Cloud support for SAML, see [SAML single sign-on]().

Before completing this guide, you must [verify ownership of any domains]() you want to associate with your SAML setup.

title: Step 1: Set up your identity provider

title: Create the Okta SAML integration application

text:
Create an Okta "Org2Org" SAML integration appliction.

1. Sign in to the Okta admin console.

1. From the left menu, select **Applications**.

1. Select **Browse App Catalog**.

1. Locate and select **Okta Org2Org**.

1. Once you have found the application, click "Add".

1. Enter this field for the **Org2Org** application **General Settings** section and select **Next**:

   * **Application label**: `Redis Cloud`

1. Enter the following fields in the **Sign-On Options > Attributes** section:

    * **Name**: `redisAccountMapping`
    * **Name Format**: `Basic`
    * **Value**: `appuser.redisAccountMapping`

To ensure the role mapping will not take effect, don't skip entering `appuser.redisAccountMapping` in the **Value** field.

1. Next, select **View Setup Instructions**. A new browser window opens, providing the information needed to configure the IdP in Redis Cloud.

1. Scroll down to section 6 in the page, and note the following information:

   * **IdP Issuer URI**
   * **IdP Single Sign-On Url**
   * **IdP Signature Certificate**: Click the link and download the certificate to your hard drive

    Once you capture the information, close the window, return to the Okta admin console, and select **Done**.

title: Modify the application user profile

text:
1. In the left menu, select **Directory > Profile Editor**, then select **Redis Cloud User**.

1. Select **Add Attribute** to add a custom attribute to the user profile and specify the Redis Cloud role.

1. Add this information for the new custom attribute:

   * **Data type**: `string array`
   * **Display name**: `redisAccountMapping`
   * **Variable nam**: `redisAccountMapping`
   * **Description**: `redisAccountMapping`
   * **Attribute required**: `Yes`
   * **Group priority**: `Combine values across groups`

1. Once you add the attribute, it appears in the list of profile attributes.

1. Add a Redis Cloud icon to the application because it's easier for users to identify the application. Select the pencil icon on the application logo and upload a Redis image using these steps:

title: Step 2: Create a group and assign the application {#createtestuser}

text: Now that our SAML IdP is configured, create an Okta group and assign the Redis Cloud application.

title: Create the group

text:
1. In the left menu, select **Directory > Groups**, then select **Add group**.

1. Enter **Name** and **Description**.

title: Assign users to the group

text:
1. Select the group, then select **Assign people**.

1. For each user you want to add to the group, highlight the user in the table and select **+**. You can also add all users by selecting **Add all**. After you add all the users to your group, select **Save**.

title: Assign application to the group

text:
Now that your group is populated with its users, assign the SAML integration application to your group.

1. From the menu, select **Applications > Applications > Redis Cloud**. Then, select **Assign to groups**.

1. In the **Redis Cloud User Group**, select **Assign**.

1. Now, define the Redis account mapping string default for this group and select **Save and go back**. The key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your **Redis Cloud Account ID** found in the [account settings](). Select **"Done"**.

    The mapping field is now defined as a default for each member of the group.

title: Editing the mapping field for the group

text:
To modify the Redis mapping field, select the pencil icon of the Redis Cloud group in the "Redis Cloud" application screen.

You can modify the mapping field for the whole group on the edit screen that appears.

title: Editing the mapping field for a specific user

text:
To override the Redis mapping field at an individual user level, select the **People** menu, then select the pencil icon of the person whos field you want to modify.

Set the user's **Assignment master** to `Administrator` to enable group policy overrides. Select **Save**.

The user's **Type** is set to `Individual`.

On the screen that appears, select the pencil icon of the user to modify the Redis mapping field.

text: Now that you have a test IdP server and your user group ready, configure support for SAML in Redis Cloud.

title: Sign in to Redis Cloud

title: Activate SAML in access management

text:
To activate SAML, you must have a local user (or social sign-on user) with the **owner** role. If you have the correct permissions, the **Single Sign-On** tab is enabled.

1. Add the information you saved previously in the **setup** form (step 1), including:

   * **Issuer (IdP Entity ID)**: IdP Issuer URI
   * **IdP server URL**: IdP Single Sign-On Url
   * **Assertion signing certificate**: Drag and drop the file you downloaded to disk in the form text area.

1. Select **Enable** and wait a few seconds for the status to change. Then, download the service provider (SP) metadata. Save the file to your local hard disk.

1. Open the file in any text editor. Save the following text from the metadata:

   * **EntityID**: Unique name of the service provider (SP)

   * **Location**: Location of the assertion consumer service

1. Return to Okta, select **Applications > Redis Cloud > General**, then select **Edit**.

1. Update this information in **Advanced Sign-on Settings**.

   * **Hub ACS URL**: Use the information that you copied for **Location**.
   * **Audience URI**: Use the information that you copied for **EntityID**.

Select **Save**.

title: IdP-initiated SSO

text:
To use IdP-initiated SSO with identity providers, set the RelayState parameter to URL `https://cloud.redis.io/#/login/?idpId=<ID>`.

Replace `<ID>` so it matches the AssertionConsumerService Location URL ID (the content after the last forward slash "/"). To learn more about configuring service provider applications, see your identity provider's documentation.

title: Return to Redis Cloud console

text:
1. Return to Redis Cloud console and select **Activate**.

   A popup appears, explaining that, to test the SAML connection, you need to log in with Okta credentials of the user defined in the Redis Cloud group. This user is part of the group to which you assigned the Redis Cloud application. Select **Continue** to go to the Okta login screen.

1. The Okta login screen appears. Enter the credentials and select **Sign In**.

If everything is configured correctly, you will see the the Redis Cloud console screen. Your local account is now considered a SAML account.

To log in to the Redis Cloud console from now on, click on **Sign in with SSO**.


title: PingIdentity SAML integration guide

summary: This integration guide shows how to set up PingIndentity as a SAML single sign-on provider for your Redis Cloud account.

page_type: content

title: Overview

role: overview

text:
This guide shows how to configure [PingIdentity](https://docs.pingidentity.com/) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account.

To learn more about Redis Cloud support for SAML, see [SAML single sign-on]().

Before completing this guide, you must [verify ownership of any domains]() you want to associate with your SAML setup.

title: Step 1: Set up your identity provider (IdP)

role: content

title: Add the `redisAccountMapping` attribute

text:
1. Log in into your Ping Identity account. Open **Administrators > Identities > User Attributes** and select **Add Attribute**.

2. Select the **DECLARED** attribute type.

3. Fill in the fields with the following values:

    * **Name**: `redisAccountMapping`
    * **Display name**: `redisAccountMapping`
    * **Description**: `redisAccountMapping`

    Select **Save and Close**. Then, verify that the attribute was created successfully.

title: Add the user who will activate SAML in Service Manager (Redis Cloud)

text:
1. Go to **Administrators > Identities > Users** and select **Add User**.

1. Fill in the following information:

    * **redisAccountMapping**: `{accountID}={role}`

    **accountID** is the account ID from [account settings]() and **role** represents the role that the user will be assigned in Redis Cloud console (owner, member, manager, billing_admin, or viewer):

    Save and check that the user was added successfully.

title: Create the Ping Identity SAML application

text:
1. Go to **Administrators > Connections > Applications** and select **+** to add a new application.

1. Choose a name for the application, select **SAML Application Type** and select **Configure**.

1. In the ACS URLs and Entity ID field add for now some dummy data, like https://example.com

    * This data will be updated with the correct data in a subsequent step.

    Select **Save**.

1. Go to the **Configuration** tab and save the following information:

    * Issuer ID
    * Single Logout Service
    * Single Signon Service

    This information will be needed once we configure SAML in the Redis Cloud console.

    * Select **Download Metadata**. An XML file will be downloaded. Open it and copy the certificate, which is required for the configuration in Redis Cloud console.

5. Go to the **Attribute Mappings** tab. Add the following attributes:

    * saml_subject
    * Email
    * FirstName
    * LastName
    * redisAccountMapping

title: Step 2: Configure SAML support in Redis Cloud

text: Now that we have our Ping Identity IdP server ready, we need to configure support for SAML in Redis Cloud.

title: Sign in to Redis Cloud

text: Sign in to your account on the [Redis Cloud console](https://cloud.redis.io/#/login).

title: Activate SAML in access management

text:
To activate SAML, you must have a local user (or social sign-on user) with the **owner** role. If you have the correct permissions, you will see the **Single Sign-On** tab.

1. Fill in the information you copied previously, including:

    * **Issuer (IdP Entity ID)**: `Issuer ID`
    * **IdP server URL**: `Single Signon Service`
    * **Single logout URL**: `Single Logout Service`
    * **Assertion signing certificate**: Certificate info you copied from the Ping Identity XML file

    Also add:

    * **Email domain binding**: The domain used in your company's email addresses

    Select **Enable** and wait a few seconds for the status to change.

1. You will then be able to **Download** the service provider (SP) metadata. Save the file to your local hard disk.

1. Open the file in any text editor. Save the following text from the metadata:

    * **EntityID**: The unique name of the service provider (SP)

    * **Location**: The location of the assertion consumer service

title: Step 3: Finish SAML configuration in Ping Identity

text:
1. In Ping Identity, go to **Administrators > Connections > Applications** and select your application name. Select the **Configuration** tab and select **Edit**.

    This is where we had entered mock data. We will now enter the correct data for this step:

    * Paste **EntityID** information in the **Entity ID** field.

    * Paste **Location** link in the ACS URLS field.

    * For the **Sign on URL** field, add URL `https://cloud.redis.io/#/login/?idpId=`, where you need to add the ID from the Reply URL ID, for example, `https://cloud.redis.io/#/login/?idpId=0oa5pwatz2JfpfCb91d7`.

    Select **Save**.

1. Select the slider to enable the app.

title: Step 4: Return to Redis Cloud console

text:
1. Return to the Redis Cloud console and select **Activate**.

1. A popup appears, explaining that to test the SAML connection, you need to log in with credentials of a user defined in Ping Federate. Select **Continue** to go to the Ping Federate login screen.

1. The Ping Federate login screen will appear. Enter the credentials and select **Sign In**.

If everything is configured correctly, you will see the the Redis Cloud console screen. Your local account is now considered a SAML account.

To log in to the Redis Cloud console from now on, click on **Sign in with SSO**.

title: IdP-initiated SSO

text:
`https://cloud.redis.io/#/login/?idpId=`

1. In Ping Identity, go to **Administrators > Connections > Applications** and select your application name. Select the **Configuration** tab and select **Edit**.

1. Go to **Target Application URL** and enter: **https://{enviroment}/#/login/?idpId={idpId}**, where idpId is the ID found in the Location field, after the last '/'

1. Select **Save**.

1. Go to **https://apps.pingone.com/{environment}/myapps/#**, where environment is the environment ID, found in **Administrators -> Environment** for your app.

   You are redirected to the Redis Cloud console.


title: Social login

summary: Social login with Redis Cloud.

title: Overview

text:
Redis Cloud supports the following social logins:
- [GitHub](https://github.com/)
- [Google](https://accounts.google.com/)

If your Google and GitHub accounts share an email address (such as Gmail), you can use either one to sign in to the same Redis Cloud account.

title: Create a new account with social login

text:
To set up Google login:

1. Select **Google** from the [sign-in](https://cloud.redis.io/) screen.
1. Sign in with the Google account you would like to use.
1. Select **Confirm** on the **Sign in with Google** prompt.

To set up GitHub login:

1. Select **Github** from the [sign-in](https://cloud.redis.io/) screen.
2. Sign in with the Github account you would like to use.
3. Select **Authorize** on the **Authorize Redis Okta Auth Github** prompt.

If the email address associated with your GitHub account is not public, you will see an error message that your sign in attempt failed. You need to [make your email address public](https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences) on GitHub before you try again.

title: Migrate an existing account to social login

text:
If you already have a Redis Cloud account that requires an email address and password to sign in, you can migrate your existing account to use a social login associated with that same email address instead.

Once you migrate your account to use social login, you cannot revert to your old email/password sign in method.

To migrate your account to Google social login:

1. Select **Google** on the [sign-in](https://cloud.redis.io/) screen.
1. Choose your preferred account from the list.
1. A confirmation prompt will display and warn that you cannot revert to your old sign in method if you proceed with the migration to social login.
1. Select **Confirm** to continue migration.

To migrate your account to GitHub social login:

1. Select **Github** on the [sign-in](https://cloud.redis.io/) screen.
1. Select **Authorize** on the **Authorize Redis Okta Auth Github** prompt.
1. Enter your GitHub password to **Confirm access**. A confirmation prompt warns that you cannot revert to your old sign-in method if you proceed with the migration to social login.
1. Select **Confirm** to continue migration.


title: Connect to Amazon Web Services PrivateLink

title: Overview

text:
[Amazon Web Services (AWS) PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-resources.html) allows service providers to securely expose specific services without exposing the entire service provider and consumer VPCs to each other. With AWS PrivateLink, Redis Cloud exposes a VPC endpoint service that you connect to as a consumer from your own VPC. Traffic stays within the AWS network and is isolated from external networks.

Connecting to Redis Cloud with an AWS PrivateLink is available only with Redis Cloud Pro.  It is not supported for Redis Cloud Essentials.

You can use PrivateLink as an alternative to Layer 3 connectivity options like [VPC peering]() and [Transit Gateway]().

AWS PrivateLink provides the following benefits:

- **Improved Security**: PrivateLink exposes the Redis cluster and database(s) as a unidirectional endpoint inside your consumer VPC, thereby avoiding exposing entire VPC subnets to each other and eliminating some possible attack vectors.
- **Network Flexibility**: PrivateLink enables cross-account and cross-VPC connectivity and can be configured even when the Redis Cloud VPC and your consumer VPC have overlapping CIDR/IP ranges.
- **Simplified architecture and low latency**: PrivateLink does not require NAT, internet gateways, or VPNs. It provides simplified network routing, without the need for a network load balancer between the application and the Redis database.

See [Connect to Redis Cloud with AWS PrivateLink](https://www.youtube.com/watch?v=i3aTmcyFihY) for a short video tutorial on how to connect to Redis Cloud with AWS PrivateLink.

title: Limitations

role: limits

text:
Be aware of the following limitations when using PrivateLink with Redis Cloud:
- You cannot use the [OSS Cluster API]() with PrivateLink during preview.
- You cannot use Layer 3 connectivity options like VPC peering or Transit Gateway with PrivateLink during private preview.
- Redis Cloud subscriptions with AWS PrivateLink are limited to a maximum of 55 databases. [Contact support](https://redis.com/company/support/) if you need more than 55 databases in one subscription with AWS PrivateLink.
- Your subnets must have at least 16 available IP addresses for the resource endpoint.
- Some AWS regions do not support PrivateLink Resource Endpoints. See [AWS VPC Lattice Pricing](https://aws.amazon.com/vpc/lattice/pricing/) for a list of regions that support AWS PrivateLink Resource Endpoints.
- Redis Cloud's PrivateLink implementation uses PrivateLink Resource Endpoints, which is based on Amazon VPC Lattice, so the [VPC Lattice quotas](https://docs.aws.amazon.com/vpc-lattice/latest/ug/quotas.html) apply. Currently, the following availability zones are not supported with Amazon VPC Lattice:
    - `use1-az3`
    - `usw1-az2`
    - `apne1-az3`
    - `apne2-az2`
    - `euc1-az2`
    - `euw1-az4`
    - `cac1-az3`
    - `ilc1-az2`

    We recommend avoiding these availability zones when creating your Redis Cloud database if you plan to use AWS PrivateLink.
- Redis Cloud [Bring your Own Cloud]() subscriptions are not supported with PrivateLink.
- The pre-handoff feature of [Smart client handoffs]() is not currently supported with AWS PrivateLink, but relaxed timeouts are available and enabled by default.

title: Prerequisites

text:
Before you can connect to Redis Cloud with an AWS PrivateLink VPC resource endpoint, you must have:

- A [Redis Cloud Pro database]() and the **Owner** or **Manager** role for your Redis Cloud account.
- An [AWS VPC](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html) with the following:
    - A [security group](https://docs.aws.amazon.com/vpc/latest/userguide/creating-security-groups.html) that allows ingress traffic to the following ports:
        - The database port range (port 10000-19999)
        - The Redis Cloud metrics port (port 8070), if desired
    - Subnets in the same region as your Redis Cloud database.
    - Settings to allow **DNS resolution** and **DNS hostnames**. See [View and update DNS attributes for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns-updating.html) for more information.
- Permission to create and manage VPC endpoints or Service networks in AWS.
- AWS CLI version 2.32 or greater if using the AWS CLI.

title: Set up PrivateLink connection

text:
To set up a connection to Redis Cloud with an AWS PrivateLink VPC resource endpoint, you need to:

1. [Associate the Redis Cloud Resource share with one or more AWS principals](#associate-resource-share).
1. [Add a connection](#add-connection) from your consumer account using a VPC resource endpoint or a VPC Lattice service network.

title: Associate Redis Cloud resource share with a principal {#associate-resource-share}

text:
In this step, you will associate the Redis Cloud resource share with an AWS principal, such as an AWS Account.

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.

1. Select **Connectivity > PrivateLink** to view the PrivateLink settings.

1. In the **Resource Share** section, select **Manage Principals** to open the **Manage Principals** window.

1. Select the **Add** button in the **AWS consumer principals** section to add a principal to the resource share.

1. Select the type of principal you want to add from the **Principal type** list. You can choose from the following principal types:

    - AWS account
    - [Organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html)
    - [Organizational unit (OU)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_ous.html)
    - [Identity and Access Management (IAM) role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)
    - [IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html)
    - Service principal

1. Enter the principal's ID in the **Principal ID** field. You can also add an optional alias in the **AWS principal alias** field.

1. Select **Share** to share the resource share with the principal. The first resource share may take a few minutes.

1. After sharing the resource share with the principal, [accept the resource share in the Resource Access Manager](https://docs.aws.amazon.com/ram/latest/userguide/working-with-shared-invitations.html) or copy the **Accept resource share** command and run it with the AWS CLI.

After you accept the resource share, the Redis Cloud console will show the principal as **Accepted**.

You can add additional principals to the resource share at any time.

title: Add a connection {#add-connection}

text:
In this step, you will add a connection from your consumer account using a VPC resource endpoint or a VPC lattice service network.

From the **Connectivity > PrivateLink** tab in your Redis Cloud subscription, open the **Add connection** section.

Here, choose whether you want to connect to Redis using a **Resource endpoint** or a **Service network**.

**Resource endpoint:**

You can connect with a VPC resource endpoint through the AWS Console or with the AWS CLI.

#### AWS Console

Follow the guide to [create a VPC resource endpoint in the AWS console](https://docs.aws.amazon.com/vpc/latest/privatelink/use-resource-endpoint.html#create-resource-endpoint-aws) with the following settings:

- **Type**: Select **Resources**.
- **Resource configurations**: Select the configuration with the same Resource Configuration ID as the one shown in the Redis Cloud console.
- **VPC**: Select your VPC from the list.
- **Additional settings**: Select **Enable private DNS name** and set **Private DNS Preference** to **Verified domains only** or **Verified domains and specified domains**.
- **Subnets**: Select the subnets to create endpoint network resources in.
- **Security groups**: Select any security groups you want to associate with the resource endpoint, including the security group that allows access to the necessary ports, as described in the [prerequisites](#prerequisites)

#### AWS CLI

To use the AWS CLI to add a VPC resource endpoint, select **Copy** under the **AWS CLI Command** to save the command to your clipboard. Enter the saved command in a terminal shell to create the resource endpoint and replace the following parameters with your own values:

- `<vpc id>`: The ID of your VPC
- `<subnet ids>`: The IDs of the subnets to create endpoint network resources in
- `<security group ids>`: The IDs of any security groups you want to associate with the resource endpoint, including the security group that allows access to the necessary ports, as described in the [prerequisites](#prerequisites)

**Service network:**

You can connect with an existing [VPC lattice service network](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-networks.html) through the AWS Console or with the AWS CLI.

#### AWS Console

Follow the guide to [Manage resource configuration associations](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-network-associations.html#service-network-resource-config-association) for your service network. Select the configuration with the same Resource Configuration ID as the one shown in the Redis Cloud console.

#### AWS CLI

To use the AWS CLI to connect to an already existing service network, select **Copy** under the **AWS CLI Command** to save the command to your clipboard. Enter the saved command in a terminal shell to connect to the service network and replace `<service network id>` with the ID of your service network.

title: Connect to your database and metrics endpoint with PrivateLink

text:
After you've connected to Redis Cloud with a VPC resource endpoint or a VPC lattice service network, you can find the endpoints for your databases and cluster metrics in the AWS UI by going to the **Associations** tab for your endpoint or service network and viewing the Private DNS entries. You will have one entry for each database and one entry for the metrics endpoint.

To view them on Redis Cloud, download the **Discovery script** from the Redis Cloud console and run it in your consumer VPC to discover the database endpoints.

The script returns a list of database endpoints that you can connect to from your consumer VPC.

[code example]

You can connect to your database by using the database `private-dns-entry` and `port` from your consumer VPC. You can also connect to the metrics endpoint with services like [Prometheus and Grafana]() by using the metrics `private-dns-entry` and `port`.

After you've connected to your database, you can view the connection details in the Redis Cloud console in your subscription's **Connectivity > PrivateLink** tab or by going to the [connection wizard]() for your database. The private endpoint will point to the PrivateLink VPC resource endpoint or service network that you created.

title: Disassociate connection

text:
To disassociate a PrivateLink connection:

1. Go to the **Connectivity > PrivateLink** tab in your Redis Cloud subscription.

1. In the **Connections** section, select **Disassociate** button next to the connection you want to disassociate.

1. Select **Disassociate VPC endpoint** or **Disassociate service network** to confirm.

After disassociating the connection, you can delete the VPC resource endpoint or service network in the AWS console.

type: metrics

dns-entry: <METRICS DNS ENTRY>

private-dns-entry: <METRIC PRIVATE DNS ENTRY>

type: database

dns-entry: <DATABASE DNS ENTRY>

private-dns-entry: <PRIVATE DNS ENTRY>


title: Connect to Amazon Web Services Transit Gateway

title: Overview

text:
[Amazon Web Services (AWS) Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html) acts as a Regional virtual router for traffic flowing between your virtual private cloud(s) (VPCs) and on-premises networks. You can attach different resources to your Transit Gateway which include:

- One or more VPCs
- One or more virtual private network (VPN) connections
- One or more AWS Direct Connect gateways
- One or more Transit Gateway Connect attachments
- One or more transit gateway peering connections

You can connect your Redis Cloud Pro subscription to a Transit Gateway which is attached to the VPC of your application. This lets your application connect securely to your Redis Cloud database while optimizing performance.

Transit Gateway is available only with Redis Cloud Pro.  It is not supported for Redis Cloud Essentials.

title: Considerations

text:
You can use Transit Gateway as an alternative to [VPC peering](), or you can enable both for your subscription.

Compared to VPC peering, Transit Gateway:

- Supports complex network topologies, such as multiple VPCs or site-to-site VPNs.

- Uses security groups and network ACLs to control traffic between VPCs.

- Has a higher network latency and cost than VPC peering due to Transit Gateway infrastructure costs.

Consider using VPC peering and Transit Gateway in parallel for the following situations:

- When migrating from one connectivity solution to the other.

- If different applications need to connect to the same database but have different latency or security requirements.

title: Prerequisites

text:
Before you can set up Transit Gateway, you need to:

1. [Create a database with Redis Cloud Pro]() from the [Redis Cloud console](https://cloud.redis.io/#/).

1. [Create a transit gateway](https://docs.aws.amazon.com/vpc/latest/tgw/create-tgw.html) from the [AWS VPC console](https://console.aws.amazon.com/vpc/) in the same region as your database.

If you use Redis Cloud Bring your own Cloud, you will need to set its IAM Instance Policy to include Transit Gateway. See [Create IAM resources using the AWS console]() for more information.

title: AWS Transit Gateway

text:
To set up Transit Gateway:

1. [Associate your resource share with the Redis AWS account](#associate-resource-share).

1. [Accept the resource share and create an attachment](#accept-resource-share).

1. [Add consumer CIDRs](#add-consumer-cidrs) to the attachment.

1. [Update AWS route tables](#update-route-tables) with the Redis Cloud producer CIDRs.

title: Associate resource share with Redis Cloud {#associate-resource-share}

text:
In this step, you will associate your resource share with your subscription's AWS account. You can do this either in the [AWS console](#aws-console) or with the [AWS CLI](#aws-cli).

#### AWS Console

To use the AWS console to set up the resource share:

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.

1. Select **Connectivity > Transit Gateway** to view the transit gateway settings.

1. In the **Share Transit Gateway** section, select **Copy** under **AWS console** to copy the Redis AWS Account number.

1. If you don't have a resource share for your transit gateway, follow the guide to [create a resource share](https://docs.aws.amazon.com/ram/latest/userguide/working-with-sharing-create.html) in the [AWS resource access manager](https://console.aws.amazon.com/ram/home). If you do, follow the guide to [update](https://docs.aws.amazon.com/ram/latest/userguide/working-with-sharing-update.html) the resource share to include the provided AWS account as an Allowed Principal.

    During the **Grant access to principals** step, select **AWS Account** in the **Select principal type** field. Enter the copied AWS account number in the **Enter an AWS Account ID** field.

    After the principal is added, it may take some time before it is associated. You can see the status of the principals under **Shared Principals** in the resource share page.

#### AWS CLI

To use the AWS CLI to set up the resource share:

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.

1. Select **Connectivity > Transit Gateway** to view the transit gateway settings.

1. In the **Share Transit Gateway** section, select **Copy** under **AWS CLI Command** to copy the Redis AWS Account number.

1. Enter the copied CLI command into a terminal shell. Replace `<TGW ARN>` with the Amazon resource name of your transit gateway.

title: Accept resource share and create attachment {#accept-resource-share}

text:
After you've associated the Redis AWS account with your resource share, you must accept the resource share in the Redis Cloud console.

1. In your Redis Cloud subscription's Transit Gateway settings, you should now see that a **Resource Share** is available. Select **Resource Shares** to view the resource share you initiated.

1. Select **Accept** to associate the **Resource Share** with your Redis Cloud console account.

1. Select **Close** to close the **Accept resource shares** section.

1. You will now see your transit gateway in the **Transit Gateways** section. After the **TGW status** is **Available**, select **Create Attachment** under **Attachment status**.

    This will request a peering attachment representing Redis's AWS account to the Transit Gateway.

1. If your transit gateway does not automatically accept peering attachment requests, the attachment will be in **Pending acceptance** status. Follow the guide to [Accept a peering attachment request](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-peering.html#tgw-peering-accept-reject) from the [AWS VPC console](https://console.aws.amazon.com/vpc/).

title: Add consumer CIDRs

text:
1. In your Redis Cloud subscription's Transit Gateway settings, in the **Transit Gateways** section, select **Add CIDRs** under **Consumer CIDRs**.

1. Enter the IPv4 CIDR of the VPC you want to connect to that is also connected to your transit gateway. To find this, go to the [AWS VPC console](https://console.aws.amazon.com/vpc/) and select **Your VPCs**.

    Select **Add** to add another CIDR if needed.

    Select **Save** to save your changes.

title: Update AWS route tables {#update-route-tables}

text:
To finish Transit gateway setup, [update your route tables for the peering connection](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-routing.html) with the following details:

1. In the **Destination** field, enter the producer deployment CIDRs.

    You can find the producer deployment CIDRs on the Redis Cloud console in the Transit Gateway settings by selecting **More actions > View Attachment** in the **Transit Gateway** section.

1. In the **Target** field, select **Transit Gateway** and select the relevant **Transit gateway ID**.

After Transit gateway is established, we recommend switching your application connection string to the private endpoint.

If you've enabled the database's [CIDR allow list](), you must also [add the Transit Gateway's IP address to the CIDR allow list]() to connect to the database via the private endpoint.

title: Continue learning with Redis University


title: Configure CIDR allow list

summary: The CIDR allow list permits traffic between a range of IP addresses and the Redis Cloud VPC.

title: Overview

text:
The [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) [allow list](https://en.wikipedia.org/wiki/Whitelist) lets you restrict traffic to your Redis Cloud database. When you configure an allow list, only the [IP addresses](https://en.wikipedia.org/wiki/IP_address) defined in the list can connect to the database. Traffic from all other IP addresses is blocked.

To use the CIDR allow list, you must be on either paid Redis Cloud Essentials or on Redis Cloud Pro.  This feature is not supported on free Redis Cloud Essentials plans.

title: Define CIDR allow list

text:
To define the CIDR allow list for a database:

1. Select **Databases** from the [Redis Cloud console](https://cloud.redis.io/) menu and then select your database from the list.

1. From the database's **Configuration** screen, select the **Edit database** button.

1. In the **Security** section, turn on the **CIDR allow list** toggle.

1. Enter the first IP address (in CIDR format) you want to allow in the text box and then select the check mark to add it to the allow list:

1. To allow additional IP addresses:

    1. Select **Add CIDR**.

    1. Enter the new IP address in the text box and then select check to add it to the allow list.

    The number of CIDR allow list entries that you can add is based on your Redis Cloud plan. Redis Cloud Essentials plans can have between 4 and 32 entries depending on the plan. Redis Cloud Pro plans can have up to 32 entries.

1. Select **Save database** to apply your changes.

The database CIDR allow list applies to both the public endpoint and the private endpoint. If you use connectivity options such as [VPC Peering]() and [Transit Gateway]() to connect to your database via the private endpoint, you must also add those IPs to your database's CIDR allow list.

title: Continue learning with Redis University


title: Block public endpoints

summary: Learn how to block the public endpoints of your databases.

title: Overview

text:
By default, you can connect to Redis Cloud databases through the database's public endpoint, or through the database's private endpoint with a private connectivity method.

Public endpoints are accessible from the public internet and don't require a private connectivity method. While this makes Redis Cloud databases convenient to use, it also exposes the databases to potential unauthorized access or brute force attacks, even with a database password in place. Some organizations may want to block public access to their databases to comply with security policies or to better meet stringent compliance standards.

Users with Redis Cloud Pro databases can choose to block public endpoints for all databases in their subscription.

After you block your database's public endpoint, any connection from an IP address that is not part of the private address space defined in [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918#section-3) will be rejected. Ensure that all connections to your database are made through a private connectivity method before blocking the public endpoint.

title: Block public endpoints

text: You can block public endpoints for a [new subscription](#new-subscription) or an [existing subscription](#existing-subscription).

title: New subscription

text:
To block the public endpoints when you [create a new Pro subscription]():

1. Follow the instructions to [create a Pro database with custom settings]().
1. On the **Setup** tab, go to **Advanced options > Security** to select persistent storage encryption options.
1. Select **Block public endpoint** to block the public endpoint for all databases on the subscription.
1. Select **Continue** to go to the [Sizing tab](). Follow the instructions to provision your database(s).

After you block the public endpoints for a new subscription, you will need to set up a [private connectivity method](#private-connectivity-methods) to connect to your databases.

title: Existing subscription

text:
For existing subscriptions, we recommend setting up a [private connectivity method](#private-connectivity-methods) to connect to your databases before blocking the private endpoint and migrating all connections to the private endpoint.

To block the public endpoints of an existing Pro subscription:

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.
1. Open the **Security** tab to view security settings.
1. In the **Endpoint** section, select **Edit**.
1. Select **Block public endpoint**.
1. Select **Save** to save your changes.
1. A window will appear asking you to confirm that blocking the public endpoint will reject clients connecting to the public endpoint. Select **I understand** and then **Block** to confirm.

After your changes are saved, any incoming connections to the public endpoint of your database will be rejected, and only connections through a private connectivity method will be allowed.

title: Turn on passwordless authentication for the default user

text:
If you have blocked the public endpoint for your Redis Cloud Pro subscription, you can turn on passwordless authentication for the [default user]() for any database in that subscription.

To turn on passwordless authentication:

1. From the database **Configuration** tab, select **Edit**.
1. In the **Security** section, select **Use passwordless auth** to turn on passwordless authentication.

1. Select **Save database** to save your changes.

title: Private connectivity methods

text:
Redis Cloud supports the following private connectivity options:
- [VPC peering]()
- [Google Cloud Private Service Connect]() _(Google Cloud only)_
- [AWS Transit Gateway]() or [AWS PrivateLink]() _(AWS only)_


title: Cloud database security

summary: Enable TLS to encrypt data communications between applications and Redis databases.

title: Transport Layer Security (TLS)

title: Network security

title: Block public endpoints

title: Overview

text:
Redis Cloud provides several features to help you secure your databases. These include
[password-based authentication]() and [role-based access control](),
[network security](), [TLS](), and [encryption-at-rest]().

title: Passwords, users, and roles

text:
All Redis Cloud databases [require a password]() to connect. However, we recommend enabling [role-based access control]() (RBAC) for additional security. With RBAC, you can define
all the roles you need, with the appropriate permissions, and assign those roles
to your users.

title: Network security

text: Redis Cloud supports two types of network security: [IP Restrictions](#ip) and [VPCs](#virtual-private-clouds). We recommend that you employ at least one of these network security options to constrain access to your databases.

title: Transport Layer Security (TLS)

text:
Redis Cloud supports [Transport Layer Security]() (TLS) for database access. TLS, often called "SSL", ensures the privacy of the TCP connection between your application and database. When client
authentication is activated, TLS ensures that only clients with an authorized key can access to your Redis databases.

We strongly recommend enabling TLS for any application transmitting sensitive data across the wire.

title: Disk encryption

text: Redis Cloud provides encryption for all data stored on disk in Redis databases. See our [encryption at rest documentation]() for specific details.

title: Continue learning with Redis University


title: Network security

title: Overview

text:
Redis Cloud supports two types of network security: database-level CIDR allow lists and [VPC](#virtual-private-clouds)-wide CIDR allow lists.

These features are available in most Redis Cloud configurations, as shown here:

| Cloud provider | VPC peering | IP restrictions |
|:-------------------:|-------------|-----------------|
| AWS | Redis Cloud Pro | Paid Redis Cloud Essentials and Redis Cloud Pro |
| Google Cloud | Redis Cloud Pro | Paid Redis Cloud Essentials and Redis Cloud Pro |
| Azure | Redis Cloud Pro | Redis Cloud Pro |

title: IP and subnet restrictions {#ip}

text:
You can restrict database access to a configurable
set of source IP addresses and subnets. This is roughly equivalent
to using [iptables](https://en.wikipedia.org/wiki/Iptables) to limit access to a host.

To restrict a database to a specific set of source IP addresses or subnets, see [Configure CIDR allow list]().

title: Virtual private clouds

text:
A [Virtual Private Cloud](https://en.wikipedia.org/wiki/Virtual_private_cloud) (VPC) is an isolated set of resources within a [public cloud](https://en.wikipedia.org/wiki/Cloud_computing#Public_cloud), usually having its own subnets and VLAN.

Redis Cloud Pro databases are almost always deployed in a Redis VPC. In most cases, you'll need to create a [VPC peering connection]() to access these databases. A VPC peering connection allows unrestricted network access between two VPCs.

Connection creation and supported features vary by public cloud provider. Learn more about VPC usage for [AWS](#vpcs-with-aws), [Google Cloud](#vpcs-with-google-cloud), and [Azure](#vpcs-with-azure).

title: VPCs with AWS

text:
Subscriptions that run on AWS support two VPC options. To ensure that that you can securely connect to your database, you need to [create a VPC peering connection]().

If you create a VPC peering connection, you can also [configure a CIDR allow list]() to allow connections only from specific IP address blocks or security groups.

title: VPCs with Google Cloud

text: Subscriptions that run on Google Cloud *require* a VPC peering connection. See [Google Cloud VPC peering]() to learn how to set up VPC peering for Google Cloud.

title: VPCs with Azure

text: When you request a Redis Cloud Annual subscription, all databases will be deployed in your own Azure VPC.


title: Transport Layer Security (TLS)

title: Overview

text:
Transport Layer Security (TLS) uses encryption to secure [network communications](https://en.wikipedia.org/wiki/Transport_Layer_Security).

Paid Redis Cloud Essentials plans and Redis Cloud Pro plans can use TLS to encrypt data communications between applications and Redis databases.

TLS is not available for Free Redis Cloud Essentials plans.

title: TLS recommendations

text:
TLS is not enabled by default.

Because TLS has an impact on performance, you need to determine whether the security benefits of TLS are worth the performance impact. TLS recommendations depend on the subscription plan and whether clients connect to your database using public or private endpoints.

This table shows TLS recommendations:

| Subscription | Public endpoint | Private endpoint |
|--------------|----------------------|------------|
| Redis Cloud Essentials        | Enable TLS           | N/A |
| Redis Cloud Pro     | Enable TLS           | Enable TLS if security outweighs performance impact |

title: Client authentication

text:
When you enable TLS, you can optionally require client authentication (also known as "mutual authentication"). If enabled, all clients must present a valid client certificate when they connect to the database.

Client authentication is not required by Redis Cloud; however, it is strongly recommended.

title: Enable TLS

text:
To enable TLS for a Redis Cloud database:

1. Select **Databases** from the [Redis Cloud console](https://cloud.redis.io/) menu and then select your database from the list.

1. From the database's **Configuration** screen, select **Edit**:

1. In the **Security** section, use the **Transport layer security (TLS)** toggle to enable TLS:

1. Select the **Download server certificate** button to download the Redis Cloud certificate bundle `redis_ca.pem`:

1. Decide whether you want to require client authentication:

    - If you only want clients that present a valid certificate to be able to connect, continue to the next step.

    - If you do not want to require client authentication, skip to the final step to apply your changes.

1. To require client authentication, select the **Mutual TLS (require client authentication)** checkbox.

1. Select **Add client certificate** to add a certificate.

1. Either provide an [X.509 client certificate](https://en.wikipedia.org/wiki/X.509) or chain in PEM format for your client or select **Generate** to create one:

    - If you generate your certificate from the Redis Cloud console, a **Download certificate** button will appear after it is generated. Select it to download the certificate.

        The download contains:

        - `redis-db-<database_id>.crt` – the certificate's public key.

        - `redis-db-<database_id>.key` – the certificate's private key.

You must download the certificate using the button at this point.  After your changes have been applied, the full bundle of public and private keys will no longer be available for download.

    - If you provide a client certificate or a certificate chain, you will see the certificate details before you save your changes.

    Select **Save** to save the client certificate.

1. You can select **Add client certificate** again to add another certificate.

1. To apply your changes and enable TLS, select the **Save database** button:

- When you enable or turn off TLS, the change applies to new connections but does not affect existing connections. Clients must close existing connections and reconnect to apply the change.

- Once you've enabled TLS, all client connections to your database must use TLS. Unencrypted connections will no longer be permitted.

title: Connect over TLS

text:
To connect to a Redis Cloud database over TLS, you need:

* A Redis client that supports TLS
* Redis Cloud CA certificates

title: Download CA certificates {#download-certificates}

text:
If you don't have the Redis Cloud CA certificates, you can download them from the Redis Cloud console:

1. Either select **Account Settings** from the Redis Cloud console menu or go to the database's **Configuration** screen.

1. Go to the **Security** section.

1. For **Redis Cloud certificate authority**, either:

    - Select the **Download** button to download the certificates from **Redis Cloud certificate authority** in **Account Settings**:

    - Select the **Download server certificate** button to download the certificates from the database's **Configuration** screen:

The download contains a file called `redis_ca.pem`, which includes the following certificates:

- Self-signed Redis Cloud Essentials plan Root CA (deprecated but still in use)

- Self-signed Redis Cloud Pro plan Root CA and intermediate CA (deprecated but still in use)

- Publicly trusted GlobalSign Root CA

The downloaded PEM file contains multiple certificates. Make sure to import **all** certificates to your client trust store. If your client code is not implemented properly, it may only import the first certificate.

To inspect the certificates in `redis_ca.pem`, run the `keytool` command:

[code example]

You can add `redis_ca.pem` to the trust store or pass it directly to a Redis client.

If your database requires client authentication, you also need the public (`redis_user.crt`) and private (`redis_user_private.key`) client keys. See
[Enable TLS](#enable-tls) for details.

title: Connect with the Redis CLI

text:
Here's how to use the [Redis CLI]() to connect to a TLS-enabled Redis Cloud database.

Endpoint and port details are available from the **Databases** list or the database's **Configuration** screen.

#### Without client authentication

If your database doesn't require client authentication, then provide the Redis Cloud CA certificate bundle (`redis_ca.pem`) when you connect:

[code example]

#### With client authentication

If your database requires client authentication, then you also need to provide your client's private and public keys:

[code example]

code: keytool -printcert -file ./redis_ca.pem | grep "Owner:"

section_id: connect-with-the-redis-cli

code:
redis-cli -h <endpoint> -p <port> --tls --cacert redis_ca.pem \
    --cert redis_user.crt --key redis_user_private.key


title: Encryption at rest

summary: Describes when data is encrypted at rest.

title: Overview

text:
Redis Cloud databases write their data to disk whenever [persistence]() is enabled.

Redis Cloud deployments are always encrypted at rest.

title: Encryption at rest on AWS {#aws}

text:
Persistent data is written to encrypted EBS volumes. For more information, see [Amazon EBS encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html).

When Auto Tiering is enabled, the flash memory data is written to encrypted NVMe SSD volumes. For more information, see [SSD instance store volumes](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ssd-instance-store.html).

title: Disk encryption on Google Cloud {#gcp}

text:
All data written to disk on Google Cloud-based Redis Cloud deployments is encrypted by default. When deploying
a Redis Cloud database on Google Cloud, you don't need to take any actions to enable this encryption.

To learn more, see the [Google Cloud Default encryption at rest](https://cloud.google.com/security/encryption-at-rest).

title: Disk encryption on Azure {#azure}

text:
All data written to disk on Azure-based Redis Cloud deployments is encrypted by default. When deploying
a Redis Cloud database on Azure, you don't need to take any actions to enable this encryption.

To learn more, see the [Azure Data Encryption at rest](https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest).

title: Continue learning with Redis University


title: Security

summary: Control who can access the Redis Cloud console and databases.

title: Access control

title: Redis Cloud shared responsibility model

title: Cloud database security

title: Configure CIDR allow list

title: Encryption at rest

summary: Private Service Connect creates a private endpoint that allows secure connections to Redis Cloud databases without exposing your application VPC.

title: Enable Google Cloud Private Service Connect

summary: VPC peering uses private IP addresses to route traffic between a Redis Cloud VPC and an application VPC.

title: Enable VPC peering

title: Overview

text:
Redis Cloud provides a number of ways to secure subscriptions and databases.

As a Redis Cloud user, consider these security domains:

- The [Redis Cloud console](#admin-console-security)
- [Your databases]()
- The [Redis Cloud API]()

First, you might want to review our [shared responsibility model]() for security.

title: Redis Cloud console security {#admin-console-security}

text:
The Redis Cloud console is the web application you use to manage your Redis Cloud deployments.

Secure access to the Redis Cloud console by:

- Assigning appropriate roles to [team members with access]().

- Enabling [multi-factor authentication]().

- Enabling [SAML SSO]().

A user session on Redis Cloud expires after 30 minutes. You'll be signed out of Redis Cloud after 30 minutes of inactivity.

title: Database security

text:
You have several options when it comes to securing your Redis Cloud databases. For more information, see [Cloud database security](). Options include:

- [Encryption at rest]()
- [Role-based access control]()
- [TLS]()
- [Network security]() using
- [VPC peering]() and [CIDR whitelist]()

title: API security

text: The Redis Cloud API allows you to programmatically administer your subscriptions and database deployments. This API is disabled by default. When you [enable the API](), you can then [manage the API keys]() for all owners of your Redis Cloud account. For an overview of the security features of the API, see the [API authentication documentation]().

title: Continue learning with Redis University


title: Overview

text:
[Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect) (PSC) creates a private endpoint that allows secure connections to Redis Cloud databases without exposing your application's [virtual private cloud](https://en.wikipedia.org/wiki/Virtual_private_cloud) (VPC).

This feature is only available for Redis Cloud Pro subscriptions hosted on Google Cloud.

title: Considerations

text:
You can use Private Service Connect as an alternative to [VPC peering](), or you can enable both for your subscription.

Compared to VPC peering, Private Service Connect:

- Only exposes the private endpoint instead of the entire application VPC network.

- Allows producer (Redis Cloud VPC) and consumer (application VPC) CIDR ranges to overlap.

- Has slightly higher network latency than VPC peering due to load balancing requirements.

Larger clusters are more likely to experience increased latency with Private Service Connect versus VPC peering.

Consider using VPC peering and Private Service Connect in parallel for the following situations:

- When migrating from one connectivity solution to the other.

- If different applications need to connect to the same database but have different latency or security requirements.

title: Set up Private Service Connect {#setup-psc}

text:
To set up Private Service Connect, you need to:

1. [Configure Private Service Connect](#configure-psc) in the Redis Cloud console.

1. [Create Private Service Connect endpoints](#create-endpoints) in the application VPC.

1. From the Redis Cloud console, review and [accept the Private Service Connect endpoint connection](#accept-psc).

title: Configure PSC {#configure-psc}

role: configuration

text:
First, configure Private Service Connect in Redis Cloud:

1. Select **Subscriptions** from the [Redis Cloud console](https://cloud.redis.io/) menu and then select your subscription from the list.

2. Select the **Connectivity** tab and then **Private Service Connect**.

3. Select the **Create connection** button:

4. Read the **Latency and cost impact** message and select **Accept and continue**:

5. For **Create connection**, enter the following **Endpoint details**:

    | Setting name | Description |
    |-------------------|-------------|
    | _Google Cloud project ID_ | Google Cloud project ID |
    | _VPC name_ | Name of the VPC that hosts your application |
    | _Subnet name_ | Name of your VPC's subnet of IP address ranges |
    | _Endpoint name_ | Prefix used to create PSC endpoints in the consumer application VPC, so endpoint names appear in Google Cloud as _endpoint name prefix + endpoint number_ |

6. Continue to the **Add connections** step:

7. Select either **Bash Shell** or **PowerShell** and then download or copy the provided `gcloud` script for later:

8. Select **Continue** to save this endpoint configuration:

title: Create endpoints {#create-endpoints}

text:
Now that you have a pending Private Service Connect entry, you need to create the endpoints in your application's VPC:

1. If you have not already done so, [enable Cloud DNS](https://cloud.google.com/dns/docs/set-up-dns-records-domain-name) for your Google Cloud project.

Since it can take some time for the DNS changes to become active, we recommend you wait 10 minutes before running the `gcloud` script in the next steps.

1. If you already have a copy of the `gcloud` script shown earlier during the **Add connections** step, you can continue to the next step.

    1. Otherwise, return to your Redis Cloud subscription's **Connectivity > Private Service Connect** screen and select **Complete setup** for the pending endpoint:

    1. Download or copy the script.

1. Use the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud) to run the script.

To ensure the `gcloud` script configures the endpoints correctly, do not make any changes to it.

The `gcloud` script creates a PSC endpoint and a DNS response policy in the consumer application VPC.

title: Accept PSC connection {#accept-psc}

text:
After the `gcloud` script finishes creating the Private Service Connect endpoint, you need to accept the connection in Redis Cloud:

1. In the Redis Cloud console, return to your subscription's **Connectivity > Private Service Connect** screen.

1. Find your pending endpoint connection in the list and select **Accept**:

title: Connect to database {#connect-db}

text:
Once your Private Service Connect endpoint is active, you can connect your application to a database:

1. From your subscription's **Connectivity > Private Service Connect** tab, select the **Connect** button for the active endpoint:

1. Select a database from the list.

1. Copy the endpoint and use it in your application to connect to your database.

Once your Private Service Connect endpoint is active, you must connect to the database from the Private Service Connect endpoint if you want to connect with Private Service connect. If you previously used the public or private endpoint to connect to your database, you must migrate any connections to the Private Service Connect endpoint.

title: Deactivate Private Service Connect {#deactivate-psc}

text:
To deactivate Private Service Connect for your subscription:

1. Select **Subscriptions** from the [Redis Cloud console](https://cloud.redis.io/) menu and then select your subscription from the list.

1. Select the **Connectivity** tab and then **Private Service Connect**.

1. For each endpoint:

    1. Select the **Delete PSC endpoint** button:

    1. Copy the provided `gcloud` script from the **Remove endpoint** dialog.

    1. Run the `gcloud` script with [`gcloud` CLI](https://cloud.google.com/sdk/gcloud) to delete the endpoint and DNS response policy.

1. After you remove all endpoints, select the **Actions** button to see a list of available actions:

1. Select **Remove service** and then **Confirm**:

Once you remove all of your Private Service Connect endpoints and deactivate it, you must migrate any connections from a Private Service Connect endpoint to the public or private endpoint of your database.

title: Limitations

text:
Private Service Connect has the following limitations in Redis Cloud:

- Although Redis Cloud supports using Private Service Connect with Enterprise clustering, you cannot use the [Cluster API]() with Private Service Connect enabled.
- The pre-handoff feature of [Smart client handoffs]() is not currently supported with Private Service Connect, but relaxed timeouts are available and enabled by default.

title: Continue learning with Redis University


title: Redis Cloud shared responsibility model

title: Overview

text: The security of all Redis Cloud deployments is a shared responsibility. Redis, the public cloud providers (Amazon Web Services [AWS], Google Cloud, and Microsoft Azure), and our customers all help ensure the security of these deployments.

title: Redis responsibility

text:
Redis Cloud's offerings are managed by Redis and deployed on AWS, Azure, and Google Cloud infrastructure.

Redis is responsible for the software that runs Redis Cloud. This includes the patching and maintenance of
the operating systems that Redis is deployed on as well as the patching and maintenance of Redis Cloud.

title: Cloud provider responsibility

text:
The public cloud provider hosting your Redis Cloud databases is responsible for the physical security of their data centers and
the security of the network, storage, servers, and virtualization that form the core infrastructure of your deployment.

Amazon, Microsoft, and Google public clouds embrace a wide range of security best practices and compliance standards. Compliance information—including audits, attestations, and certifications about resources hosted—can be found on these compliance pages:

* [AWS Compliance](https://aws.amazon.com/compliance/)
* [Google Cloud Compliance](https://cloud.google.com/security/compliance)
* [Azure Compliance](https://azure.microsoft.com/en-us/overview/trusted-cloud/compliance/)

title: Customer responsibility

text:
Customers are responsible for the security configurations in their Redis databases and the Redis Cloud console. Customers must understand and implement the Redis Cloud security features and best practices.

Customers are also responsible for the applications built on Redis and the data they store in Redis. Customers determine the cloud provider, region, and availability zone of their deployments.

Customers understand that Redis Cloud Essentials plans are deployed to a multi-tenant infrastructure. Redis Cloud Pro plans are deployed to a single-tenant infrastructure dedicated to one specific customer.

title: Continue learning with Redis University


title: Enable VPC peering

title: Overview

text:
VPC peering uses private IP addresses to allow network connections between two [virtual private clouds](https://en.wikipedia.org/wiki/Virtual_private_cloud) (VPCs).

You can connect your VPC in the Redis Cloud subscription to the VPC of your application. This lets your application connect securely to your Redis Cloud database using VPC peering to optimize the performance of your application.

VPC peering is available only with Redis Cloud Pro.  It is not supported for Redis Cloud Essentials.

VPC peering configuration requires you to initiate VPC peering on your Redis Cloud subscription and then accept the VPC peering request for the AWS VPC that you want to peer with.

title: AWS VPC peering

text:
If you want to peer a Redis Cloud VPC with an AWS VPC, you need to:

1. [Configure and initiate VPC peering](#config-aws-vpc-peering) for your Redis Cloud subscription.

1. [Approve the VPC peering request](#approve-aws-vpc-peering).

1. [Update the routes tables](#update-route-tables).

title: Configure VPC peering {#config-aws-vpc-peering}

text:
To set up VPC peering:

1. From the [Redis Cloud console](https://cloud.redis.io/), select the **Subscriptions** menu and then select your subscription from the list.

1. Select **Connectivity > VPC Peering**.

1. Select **Add peering**.

1. Enter **VPC peering** details:

    | Setting | Description |
    |-------------------|-------------|
    | _Consumer AWS Account_ | Your AWS account ID (see [Finding your AWS account ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html#FindingYourAWSId)) |
    | _Consumer region_ | AWS VPC region |
    | _Consumer VPC ID_ | The VPC ID for the application that needs to access your Redis Cloud VPC (see [Finding a VPC ID](https://docs.aws.amazon.com/managedservices/latest/userguide/find-vpc.html)) |
    | _Consumer VPC CIDRs_ | [CIDR-formatted](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) IP addresses for the AWS VPC that needs to access your Redis Cloud VPC; must not overlap with the _Redis producer VPC CIDR_ (see [View your VPCs](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-vpcs.html#view-vpc)) |

1. You can provide up to five VPC CIDRs.

    To add multiple VPC CIDRs:

    1. Select **Add CIDR**.
    1. Enter additional CIDR-formatted IP address in the box:

1. Select **Initiate peering**.
1. Note the **Peering ID** of the VPC peering request.

title: Approve VPC peering request {#approve-aws-vpc-peering}

text:
After you set up and intitiate VPC peering, you need to approve the VPC peering request:

1. Follow the AWS guide to [accept the VPC peering connection](https://docs.aws.amazon.com/vpc/latest/peering/accept-vpc-peering-connection.html).

1. After you accept the peering request, select **Modify my route tables now**. This button can be found in the green header once the peering connection is **active**.

title: Update route tables {#update-route-tables}

text:
To finish VPC peering setup, [update your route tables for the peering connection](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-routing.html). There may be many different route tables assigned to different VPCs. It is important to choose the route table assigned to the VPC you specified in the [Configure VPC Peering](#config-aws-vpc-peering) section with the following details:

1. In the **Destination** field, enter the Redis Cloud VPC CIDR shown when you accepted the peering request.

    This is the Redis Cloud VPC CIDR address, to which your application's VPC connects.

1. In the **Target** field, select **Peering Connection** and select the relevant **Peering ID**.

Once VPC peering is established, we recommend switching your application connection string to the private endpoint.

title: Google Cloud VPC peering {#gcp-vpc-peering}

text:
If you want to peer a Redis Cloud VPC with a Google Cloud VPC, you need to:

1. [Configure and initiate VPC peering](#config-gcp-vpc-peering) for your Redis Cloud subscription.

1. [Approve the VPC peering request](#approve-gcp-vpc-peering).

title: Configure VPC peering {#config-gcp-vpc-peering}

text:
To set up VPC peering:

1. Select **Subscriptions** from the [Redis Cloud console](https://cloud.redis.io/) menu and then select your subscription from the list.

1. Select **Connectivity > VPC Peering**.

1. Select **Add peering**.

1. Enter the VPC peering details:

    | Setting name | Description |
    |-------------------|-------------|
    | **Project ID** | Google Cloud project ID (see [Identifying projects](https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects)) |
    | **Network name** | Google Cloud VPC network you want to peer with (see [View networks](https://cloud.google.com/vpc/docs/create-modify-vpc-networks#viewing-networks)) |

1. Copy the **Google cloud command** after you enter the other VPC peering settings. You need this command to accept the peering request later:

1. Select **Initiate peering**.
1. Note the **Cloud peering ID** of the VPC peering request.

title: Approve VPC peering request {#approve-gcp-vpc-peering}

text:
To approve the VPC peering request between Redis Cloud and Google Cloud, use the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud) to run the **Google cloud command** that you copied before you initiated VPC peering.

Once VPC peering is established, we recommend switching your application connection string to the private endpoint.

title: Continue learning with Redis University


title: Create and edit Cloud accounts

title: Overview

text:
Redis Cloud Bring your own Cloud (BYOC) lets you use your own cloud infrastructure to deploy Redis Cloud.

You can associate your existing AWS account as a _cloud account_ for your subscription.  This requires setting up and entering credentials that enable monitoring, maintenance, and technical support of your subscription.

To do this, you need:

1. A programmatic user with an access key and a secret access key for that user.
1. A console role that allows administrative access to the cloud account.

You need to create these resources before adding the cloud account to your subscription.  To learn more, see [Create IAM resources]().

After an AWS account has been configured as a cloud account, you **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]() for more details.

title: View cloud account settings

text:
To create or edit a cloud account in Redis Cloud:

1. Sign in to the [Redis Cloud console](https://cloud.redis.io/) and then select the target subscription.

1. From the console menu, select **Account Settings** and then select the **BYOC Accounts** tab.

    This displays a list of cloud accounts associated with your Redis Cloud subscription.

The **Cloud account** tab lets you manage cloud accounts associated with your Redis Cloud subscription.

The **Cloud Account** tab is only available for accounts with Redis Cloud Bring your own Cloud (BYOC) subscriptions.

title: Add a new cloud account

text:
To add a new cloud account to your Redis Cloud subscription, select the **Add** button from the **BYOC Accounts** tab of the Account Settings screen.

This displays the **Bring your own Cloud (BYOC)** dialog.

Each of the following fields are required.

|Setting|Description|
|-------|-----------|
| _Account name_ | A descriptive name for your cloud account settings |
| _AWS access key_ | The AWS access key for the programmatic user created to support your cloud account settings |
| _AWS secret key_ | The AWS secret key for the programmatic user created to support your cloud account settings |
| _IAM role name_ | The name of the AWS console role with access to the AWS console |

Use the **Add account** button to save your cloud account details.

Be sure to create the resources before adding the cloud account to your subscription, as they're used to verify access to the cloud account.  The details can be saved only after access is verified.

When problems occur, an information icon appears and the field is highlighted in red.  When this happens, the icon includes a tooltip that explains the issue.

If the **Add account** button is inactive, verify that:

- You've specified all field values correctly
- The resources exist in your AWS account
- Each resource provides the required level of access

For help, see [Create IAM resources]().

title: Edit cloud account details

text:
To update the details of a cloud account associated with your Redis Cloud subscription, select the cloud account from the **Cloud account** tab and then select the **Edit** button.

This displays the **Edit cloud account** dialog:

|Setting|Description|
|-------|-----------|
| _Account name_ | A descriptive name for your cloud account settings |
| _AWS access key_ | The AWS access key for the programmatic user created to support your cloud account settings |
| _AWS secret key_ | The AWS secret key for the programmatic user created to support your cloud account settings |
| _IAM role name_ | The name of the AWS console role with access to the AWS console |

Use the **Update account** button to save your changes.

title: Delete cloud account

text: To remove a cloud account from your Redis cloud subscription, select the cloud account from the **Cloud account** tab and then select the **Delete** button.

title: Dedicated IAM resources

text:
We strongly recommend using dedicated identity and access management (IAM) resources to manage your AWS cloud accounts.  These resources should not be shared with any other task, account, or process.

To learn more, see [Create IAM resources for AWS cloud accounts]().


title: Create IAM resources using AWS console

title: Overview

text:
Follow these steps to manually create IAM resources using the [AWS console](https://console.aws.amazon.com/).

We use the provided credentials to configure your AWS environment and provision required resources.

You **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]() for more details.

title: Step 1: Create the IAM instance policy

text:
The IAM instance policy controls the permissions for the instances that Redis Cloud creates in your AWS account.

Follow the steps to [create an IAM policy using the JSON editor](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html#access_policies_create-json-editor) with the following settings:

- In **Specify permissions**, select **JSON**, and then enter the contents of the RedisLabsInstanceRolePolicy.json policy file:

- In **Review and Create**, enter `RedisLabsInstanceRolePolicy` in the **Policy name** field.

Select **Create policy** to finish policy creation.

title: Step 2: Create the service role

text:
After creating the instance role policy, you must create a role to assign the policy.

Follow the steps to [create a role for an AWS service](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html#roles-creatingrole-service-console) with the following settings:

- In **Select trusted entity**:
    - **Trusted entity**: Select **AWS service**.
    - **Service or use case**: Select **EC2**.
    - **Use case**: Select **EC2**.
- In **Add permissions**, select the **RedisLabsInstanceRolePolicy** you created.
- In **Name, review, and create**, enter `redislabs-cluster-node-role` in the **Role name** field.

Select **Create role** to finish role creation.

title: Step 3: Create the user policy

text:
The user policy controls the permissions for the user that Redis Cloud uses to manage your AWS account.

Follow the steps to [create an IAM policy using the JSON editor](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html#access_policies_create-json-editor) with the following settings:

- In **Specify permissions**, select **JSON**, and then enter the contents of the RedisLabsIAMUserRestrictedPolicy.json policy file:

- In **Review and Create**, enter `RedislabsIAMUserRestrictedPolicy` in the **Policy name** field.

Select **Create policy** to finish policy creation.

title: Step 4: Create the programmatic access user

text:
After you create the user policy, you must create a programmatic access user and attach the policy to it.

Follow the steps to [create a user on the AWS console](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html), with the following settings:

- In **Specify user details**, For **User name**, enter `redislabs-user`.
- In **Set permissions**:
    - **Permissions options**: Select **Attach existing policies directly**.
    - **Permissions policies**: Select the **RedislabsIAMUserRestrictedPolicy** you created from the list.

Select **Create user** to create the user.

After you create the user, you need to add an access key for the user.

Follow the steps to [create an access key](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-keys-admin-managed.html#admin-create-access-key) for the user you just created. Save the access key ID and secret access key in a secure location.

title: Step 5: Create the console access role

text:
The console access role controls the permissions for the user that Redis Cloud uses to access the AWS console.

Follow the steps to [Create a role for an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) with the following settings:

- In **Select trusted entity**:
    - **Trusted entity**: Select **AWS account**.
    - **An AWS account**: Select **Another AWS account**.
    - **Account ID**: Enter account number `168085023892` (Redis Cloud's AWS account).
    - **Options**: Select **Require MFA**.

Do not check the **Require external ID** checkbox.

- In **Add permissions**, select the **RedislabsIAMUserRestrictedPolicy** you created.
- In **Name, review, and create**, enter `redislabs-role` in the **Role name** field.

Select **Create role** to finish role creation. Save the Role name for later.

title: Next steps

text:
When you've finished creating all of the resources, you can [create a Cloud Account]() in the Redis Cloud console. To do this, you'll need the following information:

- **Access Key ID**: The Access Key ID for the [programmatic user you created](#step-4-create-the-programmatic-access-user).
- **Secret Access Key**: The Secret Access Key for the [programmatic user you created](#step-4-create-the-programmatic-access-user).
- **IAM Role Name**: The name of the [console access role you created](#step-5-create-the-console-access-role).


title: Create IAM resources using CloudFormation

title: Overview

text:
You can use [AWS CloudFormation](https://aws.amazon.com/cloudformation/) to create the IAM resources for Redis Cloud Bring your Own Cloud (BYOC).

We use the provided credentials to configure your AWS environment and provision required resources.

You **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]() for more details.

title: Create resources using CloudFormation on the AWS Console

text:
The following link uses CloudFormation to create a stack using the AWS console:

When the stack finishes, select the stack and then the **Outputs** tab. You need the following information to [create a Cloud Account]() in the Redis Cloud console:

- **Access Key ID**: The `accessKeyId` output.
- **Secret Access Key**: Follow the link to AWS Secrets Manager in the `accessSecretKey` output and select **Retrieve secret value**.
- **IAM Role Name**: The `IAMRoleName` output.

title: Create resources using CloudFormation through AWS CLI

text:
You can also use the AWS command-line interface (CLI) to create the stack:

[code example]

You can track the status of the cloud formation with the following command:

[code example]

After the stack finishes, you can retrieve the outputs from the `Outputs` section of the response.

You need the following information to [create a Cloud Account]() in the Redis Cloud console:

- **Access Key ID**: The `accessKeyId` output.
- **Secret Access Key**: Extract the secret ID from the `accessSecretKey` output. The secret ID is the `name` query parameter in the `accessSecretKey` output.

    For example, if the `accessSecretKey` output is `https://console.aws.amazon.com/secretsmanager/home?region=<region>/secret?name=/redislabsuser/secret_access_key`, then the secret ID is `/redislabsuser/secret_access_key`.

    Use the secret ID to retrieve the secret value using the AWS secretsmanager CLI:

    [code example]
    Replace `<accessSecretKey-ID>` with the secret ID you extracted from the `accessSecretKey` output.
- **IAM Role Name**: The `IAMRoleName` output.

code:
aws cloudformation create-stack --stack-name RedisCloud --template-url \
https://s3.amazonaws.com/iam-resource-automation-do-not-delete/RedisCloud.yaml \
--capabilities CAPABILITY_AUTO_EXPAND CAPABILITY_NAMED_IAM CAPABILITY_IAM

code: aws cloudformation describe-stacks --stack-name RedisCloud

code: aws secretsmanager get-secret-value --secret-id=<accessSecretKey-ID>


title: Create IAM resources for AWS cloud accounts

title: Create IAM resources using AWS console

title: Create IAM resources using Terraform

title: Content

text:
For Redis Cloud Bring your Own Cloud (BYOC) on Amazon Web Services (AWS), we manage the supporting infrastructure for you in dedicated AWS accounts.

You can manage this infrastructure with your own AWS accounts.

You'll want these accounts to be separate from any AWS application accounts
and you'll need to create dedicated [identity and access management](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) (IAM) resources to allow us to manage the infrastructure.

In the new AWS account, you need to create:

- An **instance role**
- A user with an **access key**
- A role that grants **AWS console access**

Save the access key in a secure location so that you can enter it when you [register the cloud account]() with your Redis Cloud subscription.

We use the provided credentials to configure your AWS environment and provision required resources.

You **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]() for more details.

For help creating an AWS user, see the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).

You can use one of the following tools to create IAM resources:

- [CloudFormation]()
- [Terraform]()
- The [AWS Console]()


title: Create IAM resources using Terraform

title: Content

text:
You can use [HashiCorp Terraform](https://www.terraform.io/intro/index.html) to create identity and access management (IAM) resources to support AWS cloud account access to Redis Cloud subscriptions.

We use the provided credentials to configure your AWS environment and provision required resources.

You **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]() for more details.

The following example uses the `terraform-aws-Redislabs-Cloud-Account-IAM-Resources` module, located in Amazon S3:

1. Copy the following code into a file called `main.tf`.

    Replace the following values in the `main.tf` file:

    - `<profile>`: The AWS CLI profile to use.
    - `<region>`: The AWS region to use.
    - `<pgp_key>`: The PGP key to use. For details, see the [Terraform docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_login_profile#pgp_key).

2. Initialize Terraform with the module:

    Note: Terraform requires [AWS credentials be supplied](https://www.terraform.io/docs/language/modules/sources.html#s3-bucket), but the source of the module is a public S3 bucket, so any valid credentials should work.

    [code example]

    Replace `<access_key_id>` and `<secret_key>` with valid AWS keys.

3. Build the resources and display the outputs:

    [code example]

    You need the following information to [create a Cloud Account]() in the Redis Cloud console:

    - **Access Key ID**: The `accessKeyId` output.
    - **Secret Access Key**: Run the following command to extract the secret key from the `accessSecretKey` output:
        [code example]
    - **IAM Role Name**: The `IAMRoleName` output.

code: AWS_ACCESS_KEY_ID=<access_key_id> AWS_SECRET_KEY=<secret_key> terraform init

section_id: content

code: terraform apply

code: echo $(terraform output -raw accessSecretKey)


title: Redis Cloud Bring your own Cloud

summary: Describes how to provision your Redis Cloud subscription to use an existing cloud provider account.

title: Create and edit Cloud accounts

title: Configure subscription CIDR allow list

title: Overview

text:
Redis Cloud Bring your own Cloud (BYOC) allows organizations to use their own cloud infrastructure to deploy Redis Cloud.

By default, Redis hosts the infrastructure that runs Redis Cloud. However, if your organization has specific requirements, you may need to have more control over your data residency or security options. Redis Cloud BYOC lets you fulfill these requirements while still having a fully managed service experience of Redis Cloud. Like standard Redis Cloud, Redis manages deployment, scaling, monitoring, and support, so you can focus on building applications while Redis manages the backend.

Redis Cloud BYOC availability requires approval from Redis. If you're interested, [contact sales](https://redis.io/meeting/).

title: Benefits of Redis Cloud BYOC

text:
Redis Cloud BYOC has some benefits over standard Redis Cloud:

- **Full Data Control**: All data stays within your environment, giving you complete control over data security and reducing risks associated with data sovereignty.
- **Simplified Compliance**: BYOC simplifies adherence to regulatory standards like GDPR, HIPAA, and compliance frameworks like SOC 2 and PCI DSS since data remains within your own cloud account.
- **Maximize Cloud Commitments**: Infrastructure costs are billed directly through your cloud provider account, enabling you to fully utilize existing commitments.
- **Separation of Costs**: Customers pay Redis only for licensing and management, while infrastructure costs go directly to the cloud provider, offering clear visibility into each cost stream.
- **Instant Access Control**: You can revoke Redis’ access to your environment at any time, offering complete control over data and infrastructure.

title: Redis Cloud BYOC Use cases

text:
Consider using Redis Cloud BYOC if you have specific organizational needs or requirements, such as:

- **Data Residency and Compliance**: Organizations operating in heavily regulated industries (such as finance, healthcare, and government) can use Redis Cloud BYOC to meet strict data residency and sovereignty requirements, ensuring sensitive data remains within their controlled environments.
- **Cloud spend optimization**: Companies with significant cloud provider commitments can use Redis Cloud BYOC to optimize their cloud spend. Since infrastructure costs are billed directly through the cloud provider, customers can fully utilize existing cloud provider discounts, improving cost efficiency.
- **Enhanced Security and Control**: Redis Cloud BYOC is ideal for organizations that require a higher degree of security and control over their data. By keeping data within your own cloud account, you can use existing security policies, tools, and procedures in your cloud’s security infrastructure. In this way, you can minimize external access to your data, and adhere to more strict organizational security guidelines.

title: Set up Redis Cloud BYOC

text:
To set up Redis Cloud BYOC on Amazon Web Services (AWS):

1. [Create the Identity and Access Management (IAM) resources]() needed to let Redis create, monitor, and maintain deployment infrastructure.

1. [Set your AWS Account as a BYOC Cloud account]() on Redis Cloud.

After you set up your cloud account, you can create a [new Redis Cloud Pro subscription]() or an [Active-Active database]() that uses your cloud account.

title: Redis Cloud BYOC pricing

text:
With Redis Cloud BYOC, you pay for the Redis Cloud service, including database management, monitoring, and support.  You also pay for the underlying cloud infrastructure, including virtual machines, storage, and networking, directly to your cloud provider.

When you create a database, you'll see the costs for the Redis Cloud service, but not the costs for the underlying cloud infrastructure. You can view and manage those costs in your cloud provider account.

title: Avoid Redis Cloud BYOC service disruption {#avoid-service-disruption}

text:
Failing to follow the instructions in this section will cause your databases to become inaccessible, and Redis will not be able to ensure cluster and database stability. Please read them carefully.

To keep your Redis Cloud BYOC service and all databases running without issues:
- Do not stop, delete, or modify Redis-managed resources through the cloud provider - including VPCs, subnets, virtual machines, and other infrastructure.
- Do not change roles or access policies.

If you make any infrastructure changes, whether or not they are listed above, it may violate our SLA commitments. See [Appendix 1 in our Terms of Service](https://redis.io/legal/cloud-tos/#Appendix-1) for more details.


title: Configure subscription CIDR allow list

title: Overview

text:
The [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) [allow list](https://en.wikipedia.org/wiki/Whitelist) lets you restrict traffic to your Redis Cloud database. When you configure an allow list, only the [IP addresses](https://en.wikipedia.org/wiki/IP_address) defined in the list can connect to the database. Traffic from all other IP addresses is blocked.

If you use [Redis Cloud Bring your Own Cloud]() to host your Redis Cloud deployment, you can configure a subscription-wide allow list
to restrict traffic to all databases associated with the subscription.

The subscription CIDR allow list defines a range of IP addresses and [AWS security groups](https://docs.aws.amazon.com/managedservices/latest/userguide/about-security-groups.html) that control inbound and outbound traffic to the Redis Cloud [VPC](https://en.wikipedia.org/wiki/Virtual_private_cloud). When you add security groups to the allow list, you can also use the same security groups to manage access to your application.

The subscription-level allow list is available for Redis Cloud Bring your Own Cloud. If you don't have Redis Cloud Bring your Own Cloud, you can configure a [CIDR allow list]() for each database.

title: Allow IP address or security group

text:
To add IP addresses or [AWS security groups](https://docs.aws.amazon.com/managedservices/latest/userguide/about-security-groups.html) to a subscription's allow list:

1. From the [Redis Cloud console](https://cloud.redis.io/) menu, select **Subscriptions** and then select your subscription from the list.

1. Select **Connectivity > Allow List**.

1. If the allow list is empty, select **Add allow list**.

1. Select an entry **Type** from the list:

1. In the **Value** box, enter one of these options:

    - An IP address in CIDR format

    - The AWS security group ID

1. Select the check to add the entry to the allow list.

1. To allow additional IP addresses or security groups:

    1. Select **Add** to add a new entry.

    1. Select the new entry's **Type**, enter the **Value**, and select the check to add it to the allow list.

    You can also select the **Edit** button to change an entry or the **Delete** button to remove it.

1. Select **Apply all changes** to apply the allow list updates.


title: Delete a subscription

title: Content

text:
Once a subscription is deleted, it cannot be recovered. We recommend [backing up your data]() before removing databases or subscriptions.

To delete a subscription:

1.  [Delete all databases]() from the subscription.

    The number of databases for the subscription is shown in the subscription list. You cannot delete a subscription until there are zero databases in the subscription.

2.  View the subscription details.

    If you have more than one subscription, select the target subscription from the subscription list.

3.  Select the **Overview** tab.

4.  Select the **Delete subscription** button.

5.  Select the **Delete subscription** button to confirm your choice.


title: Manage subscriptions

title: View and Upgrade Redis Cloud Essentials plan

title: View and edit Redis Cloud Pro plan

summary: Upgrade your Redis Cloud Essentials subscription to a Redis Cloud Pro subscription.

title: Upgrade database from Redis Cloud Essentials to Redis Cloud Pro

title: Delete a subscription

title: Redis Cloud Bring your own Cloud

summary: Describes maintenance that Redis performs on a Redis Cloud subscription.

title: Subscription and database maintenance

title: Overview

text: This page helps you manage your Redis Cloud subscriptions; it briefly compares available plans and shows where to find help with common tasks.

title: Subscription plans

text:
As of April 2024, Redis Cloud supports the following subscription plans:

- [Free Redis Cloud Essentials](#free-rce)
- [Paid Redis Cloud Essentials](#paid-rce)
- [Essentials with Redis Flex](#redis-flex)
- [Redis Cloud Pro](#redis-cloud-pro)

Here's a quick comparison of each plan:

| Feature | Redis Cloud Essentials (free) | Redis Cloud Essentials (paid) | Essentials with Redis Flex | Redis Cloud Pro |
|:---:|:---:|:---:|:---:|:---:|
| Memory size | 30 MB | 250 MB-12 GB | 1 GB-100GB | 50 TB |
| Concurrent connections | 30 | 256-10000 | 1024-10000 | Unlimited |
| Security | Role-based auth
Password protection
Encryption in transit | Role-based auth
Password protection
TLS auth
Encryption in transit | Role-based auth
Password protection
TLS auth
Encryption in transit | Role-based auth
Password protection
TLS auth
Encryption in transit
Encryption at rest
Private Connectivity |
| REST API | No | Yes | Yes | Yes |
| Selected additional features

 |  | Replication
Auto-failover
 | Replication
Auto-failover
 | Dedicated accounts
Redis Flex
Active/Active
 |

To learn more, see [Redis Cloud Pricing](https://redis.io/pricing/).

title: Free Redis Cloud Essentials {#free-rce}

text: Free plans are a type of Redis Cloud Essentials plans designed for training purposes and prototyping. They can be seamlessly upgraded to other Redis Cloud Essentials plans with no data loss.

title: Paid Redis Cloud Essentials {#paid-rce}

text:
Redis Cloud Essentials is cost-efficient and designed for low-throughput scenarios. It support a range of availability, persistence, and backup options.  Pricing supports low throughput workloads. See [Redis Cloud Essentials plans]() for a list of available plans.

- [View and upgrade Essentials or Flex plan]()

#### Essentials with Redis Flex {#redis-flex}

You can select Redis Cloud Essentials plans that support a tiered solid state drive (SSD) and RAM architecture. Using SSDs instead of RAM significantly reduces infrastructure costs, which means developers can build applications that require large datasets using the same Redis API.

Redis Flex is ideal when your:

- working set is significantly smaller than your dataset (high RAM hit rate)
- average key size is smaller than average value size (all key names are stored in RAM)
- most recent data is the most frequently used (high RAM hit rate)

See [Create a Redis Flex database]() to learn more about Redis Flex, and see [Redis Flex plans]() for a list of available plans.

- [View and upgrade Essentials or Flex plan]()

title: Redis Cloud Pro

text:
Redis Cloud Pro supports more databases, larger databases, greater throughput, and unlimited connections compared to Redis Cloud Essentials. Hosted in dedicated VPCs, they feature high-availability in a single or multi-AZ, Active-Active, clustering, data persistence, and configurable backups.  Pricing is "pay as you go" to support any dataset size or throughput. [Redis Flex]() is also available on Redis Cloud Pro.

Redis Cloud Pro annual plans support the same features as Redis Cloud Pro but at significant savings. Annual plans also provide Premium support. The underlying commitment applies to all workloads across multiple providers and regions.

- [View and edit Pro subscription]()
- [Upgrade from Essentials to Pro]()
- [Subscription maintenance]()