{
  "schema_version": 2,
  "id": "operate/radar/connect",
  "title": "Connect clusters",
  "url": "https://redis.io/docs/latest/operate/radar/connect/",
  "summary": "Add Redis Software, Redis Cloud, Redis Open Source, Amazon ElastiCache, and Google Memorystore sources to Radar.",
  "tags": [
    "docs",
    "operate",
    "radar"
  ],
  "last_updated": "2026-09-06T07:25:30-05:00",
  "page_type": "content",
  "content_hash": "d2296dcea8a07d10edb0506323b727e483300b13cdf006c73967ae461154fb60",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "After installing Redis Radar, it's time to connect your clusters. Add each cluster manually — Radar doesn't discover clusters on its own. After you add a cluster, Radar tests the connection and then keeps collecting that source's state automatically going forward. While Radar lets you view your cluster's status, it doesn't change the any of the cluster settings or configuration."
    },
    {
      "id": "what-you-can-connect",
      "title": "What you can connect",
      "role": "content",
      "text": "| Type | How Radar reaches it | What you supply |\n|---|---|---|\n| [Redis Software](#connect-a-redis-software-cluster) | The cluster REST API, over HTTPS on port 9443 | A hostname or IP address, plus an account on the cluster |\n| [Redis Open Source](#connect-a-redis-open-source-instance) | Direct access to the Redis instance | A hostname and port, plus credentials if the instance requires them |\n| [Redis Cloud](#connect-a-redis-cloud-account) | The Redis Cloud API | An account key and a user secret |\n| [Amazon ElastiCache](#connect-amazon-elasticache) | The AWS control-plane APIs | Read-only AWS credentials and the regions to scan |\n| [Google Memorystore](#connect-google-memorystore) | The Google Cloud APIs | A read-only service account, plus the project and regions to scan |\n\nRadar encrypts every credential before storing it. Credentials are never returned through the API and never written to logs.\n\n![images/radar/add-connection.png](https://redis.io/docs/latest/images/radar/add-connection.png)"
    },
    {
      "id": "self-managed-connections",
      "title": "Self-managed connections",
      "role": "content",
      "text": "Connect Redis Software clusters and Redis Open Source instances that you run yourself. Radar reaches each one directly, so you supply a host and an account on the cluster or instance. Redis Software and Redis Open Source connections are per cluster or per instance."
    },
    {
      "id": "before-you-connect",
      "title": "Before you connect",
      "role": "content",
      "text": "For every connection you need:\n\n- **Credentials for the cluster or instance.** Radar uses the same management interface you do, so it needs an account there. Read access is enough.\n- **Network access from Radar to the source.** Radar connects outbound. Nothing needs to connect back to Radar, so no inbound rule is required on the Radar host."
    },
    {
      "id": "connect-a-redis-software-cluster",
      "title": "Connect a Redis Software cluster",
      "role": "content",
      "text": "Radar reads Redis Software clusters through the cluster REST API.\n\n1. Select **Add connection**, from either the top bar or the **Connections** page.\n2. Set the **connection type** to **Redis Software**.\n3. Enter a **display name**. Use something you can recognize in a fleet-wide list, such as `Production East 1`.\n4. Enter the cluster's **hostname or IP address**, for example `cluster.redis.internal` or `10.0.0.1`.\n5. Enter the **port**. The default is `9443`, the cluster REST API port.\n6. Enter the **username** and **password** of an account on the cluster.\n7. Select **Add connection**.\n\nRadar tests the connection before it saves anything. If the test fails, Radar shows the error and does not create the connection, so you can correct the details and select **Retry**.\n\nRadar always reaches the REST API over HTTPS.\n\n![images/radar/add-connection-redis-software.png](https://redis.io/docs/latest/images/radar/add-connection-redis-software.png)\n\n\nPoint Radar at the cluster's fully qualified domain name rather than one node's address. A node address works until that node is unavailable, at which point Radar reports the whole cluster as unreachable."
    },
    {
      "id": "connect-a-redis-open-source-instance",
      "title": "Connect a Redis Open Source instance",
      "role": "content",
      "text": "Radar connects straight to the instance, so it needs network access to that endpoint.\n\n1. Select **Add connection**.\n2. Set the **connection type** to **Redis Open Source**.\n3. Enter a **display name**.\n4. Enter the **hostname or IP address** and **port**. The default port is `6379`.\n5. Enter a **username** and **password** if the instance requires authentication. Leave both empty if it does not.\n6. Select **Use TLS (rediss://)** if the instance requires an encrypted connection.\n7. Select **Add connection**.\n\n![images/radar/add-connection-redis-open-source.png](https://redis.io/docs/latest/images/radar/add-connection-redis-open-source.png)"
    },
    {
      "id": "cloud-connections",
      "title": "Cloud connections",
      "role": "content",
      "text": "Connect a Redis Cloud account, Amazon ElastiCache, or Google Memorystore. These connections use each provider's own API rather than talking to a database directly, so what you supply is API credentials rather than an account on a cluster. One Redis Cloud connection covers every subscription and database in that account, and one ElastiCache or Memorystore connection covers every resource in the regions you select. ElastiCache and Memorystore resources appear on the **Databases** view rather than **Clusters**."
    },
    {
      "id": "before-you-connect-1",
      "title": "Before you connect",
      "role": "content",
      "text": "For every connection you need:\n\n- **API credentials for the provider.** A Redis Cloud account key and user secret, read-only AWS credentials, or a read-only Google Cloud service account. Radar never writes to your Redis Cloud subscription or provider account.\n- **The regions to scan, for Amazon ElastiCache and Google Memorystore.** Radar only scans the regions you list.\n- **Network access from Radar to the provider's API.** Radar connects outbound only."
    },
    {
      "id": "connect-a-redis-cloud-account",
      "title": "Connect a Redis Cloud account",
      "role": "content",
      "text": "A Redis Cloud connection uses the Redis Cloud API, so it covers every subscription and database in the account at once.\n\n1. Create a Redis Cloud API key. You need both the **account key** and a **user secret**. See [Redis Cloud API](https://redis.io/docs/latest/operate/rc/api).\n2. In Radar, select **Add connection**.\n3. Set the **connection type** to **Redis Cloud**.\n4. Enter a **display name**.\n5. Enter the **account key** and the **user secret**.\n6. Select **Add connection**.\n\n![images/radar/add-connection-redis-cloud.png](https://redis.io/docs/latest/images/radar/add-connection-redis-cloud.png)"
    },
    {
      "id": "connect-amazon-elasticache",
      "title": "Connect Amazon ElastiCache",
      "role": "content",
      "text": "One ElastiCache connection covers every ElastiCache resource in the regions you select.\n\n**Amazon ElastiCache** appears in the connection type list only if an administrator enabled the ElastiCache connector, which is off by default.\n\nBefore you connect, create an AWS identity with read-only ElastiCache access. The policy needs no write permissions and no cache data-plane permissions:\n\n- `elasticache:DescribeReplicationGroups`\n- `elasticache:DescribeCacheClusters`\n- `elasticache:DescribeServerlessCaches`\n- `cloudwatch:GetMetricData`\n- `tag:GetResources`\n- `ec2:DescribeRegions`\n\nOn a self-managed install, Radar authenticates with a long-lived IAM access key pair:\n\n1. Select **Add connection**.\n2. Set the **connection type** to **Amazon ElastiCache**.\n3. Enter a **display name**.\n4. Enter the **AWS access key ID** and **AWS secret access key**.\n5. Enter the **AWS regions** to scan, separated by commas, for example `us-east-1, us-west-2`.\n6. Select **Add connection**.\n\nRadar derives the AWS account ID itself, so you do not enter it.\n\nBoth the API server and the worker need outbound HTTPS on port 443 to the AWS control-plane endpoints in every region you configure: `sts`, `elasticache`, `monitoring`, `tagging`, and `ec2`. Radar never opens a connection to a cache endpoint.\n\n![images/radar/add-connection-amazon-elasticache.png](https://redis.io/docs/latest/images/radar/add-connection-amazon-elasticache.png)\n\n\nBlocking the CloudWatch or tagging endpoints degrades what Radar can report and produces a capability warning. Blocking the identity or ElastiCache inventory endpoints stops the connection test and collection outright."
    },
    {
      "id": "connect-google-memorystore",
      "title": "Connect Google Memorystore",
      "role": "content",
      "text": "One Memorystore connection covers every Memorystore resource in the regions you select, across the Redis, Valkey, and Memcached engines.\n\n**Google Memorystore** appears in the connection type list only if an administrator enabled the Memorystore connector, which is off by default.\n\nBefore you connect, create a service account in the target project and grant it the read roles for the engines you run:\n\n| Role | Covers |\n|---|---|\n| `roles/redis.viewer` | Memorystore for Redis and Redis Cluster |\n| `roles/memorystore.viewer` | Memorystore for Valkey only |\n| `roles/memcache.viewer` | Memorystore for Memcached |\n| `roles/monitoring.viewer` | Cloud Monitoring metrics for every engine |\n\nA single custom role with the same read permissions works too.\n\nOn a self-managed install, Radar authenticates with a service account key:\n\n1. Select **Add connection**.\n2. Set the **connection type** to **Google Memorystore**.\n3. Enter a **display name**.\n4. Enter the **GCP project ID**, for example `my-gcp-project`.\n5. Enter the **GCP regions** to scan, separated by commas, for example `us-central1, us-east1`.\n6. Paste the **service account key JSON**. It must be 16 KiB or less.\n7. Select **Add connection**.\n\nBoth the API server and the worker need outbound HTTPS on port 443 to `oauth2.googleapis.com`, `redis.googleapis.com`, `memorystore.googleapis.com`, `memcache.googleapis.com`, and `monitoring.googleapis.com`. Allowing `*.googleapis.com` covers the whole path.\n\n![images/radar/add-connection-google-memorystore.png](https://redis.io/docs/latest/images/radar/add-connection-google-memorystore.png)"
    },
    {
      "id": "secure-cluster-connections",
      "title": "Secure cluster connections",
      "role": "content",
      "text": "Radar holds credentials for every cluster in your fleet, so treat the connection path as sensitive.\n\n- **Encrypt the connection.** Redis Software connections always use HTTPS. For Redis Open Source, select **Use TLS** unless the instance is unencrypted and you accept that.\n- **Give Radar its own account on each cluster.** A dedicated account keeps Radar's access auditable and separate from any user's, and lets you limit what Radar can do.\n- **Protect the encryption key.** On a self-managed install, every credential Radar stores is encrypted with the key you supplied at install. Back that key up alongside the database and store the backup separately. See [Install Radar](https://redis.io/docs/latest/operate/radar/install#the-credential-encryption-key)."
    },
    {
      "id": "remove-or-reconnect-a-cluster",
      "title": "Remove or reconnect a cluster",
      "role": "content",
      "text": "Only administrators can remove a connection. See [Manage access](https://redis.io/docs/latest/operate/radar/manage-access).\n\nRadar has no way to edit a saved connection's credentials, host, port, or scanned regions. If any of those change — for example, a rotated password or access key, or a cluster that moved to a new address — remove the connection and add it again with the new details.\n\nTo remove a connection:\n\n1. Go to the **Connections** page.\n2. Select **More options** next to the connection.\n3. Select **Remove connection**.\n4. Confirm the removal.\n\nRemoving a connection permanently deletes the health and usage data Radar collected through it. It does not affect the underlying Redis deployment or cloud account, and it cannot be undone.\n\n\nFor a Redis Cloud account connection, removing it removes every subscription discovered through that account, not just one database."
    },
    {
      "id": "next-steps",
      "title": "Next steps",
      "role": "content",
      "text": "Radar starts collecting information as soon as a connection is saved. The first collection populates the fleet view, and Radar refreshes each source after that. See [Monitor clusters and databases](https://redis.io/docs/latest/operate/radar/monitor)."
    }
  ],
  "examples": []
}