Can you connect to Amazon ElastiСache Redis outside of Amazon?

Question

I'm able to connect to an ElastiCache Redis instance in a VPC from EC2 instances. But I would like to know if there is a way to connect to an ElastiCache Redis node outside of Amazon EC2 instances, such as from my local dev setup or VPS instances provided by other vendors.

Currently when trying from my local set up:

redis-cli -h my-node-endpoint -p 6379

I only get a timeout after some time.

score 124 · Answer 1 · edited Jan 28 '21 at 12:33

124

SSH port forwarding should do the trick. Try running this from you client.

ssh -f -N -L 6379:<your redis node endpoint>:6379 <your EC2 node that you use to connect to redis>

Then from your client

redis-cli -h 127.0.0.1 -p 6379

It works for me.

Please note that default port for redis is 6379 not 6739. And also make sure you allow the security group of the EC2 node that you are using to connect to your redis instance into your Cache security group.

Also, AWS now supports accessing your cluster more info here

edited Jan 28 '21 at 12:33

Thales Minussi

6,965
1
30
48

answered Feb 20 '14 at 23:04

Rico

58,485
12
111
141

Thanks for pointing out the port, just a typo. So, are you saying that SSH tunneling through EC2 is the only way to gain access to an elasticache node outside Amazon? Thanks, – Loic Duros Feb 21 '14 at 13:10
That's correct just like @E.J.Brennan mentioned in the other answer. – Rico Feb 21 '14 at 15:17
How we can revoke ssh port forwarding...? – Muthukumar K May 05 '20 at 18:31
you can kill the ssh process. On Linux: `kill -9 ` – Rico May 05 '20 at 18:50
1

Note that the `-f` option makes the `ssh` command execute as a process in the background, which may not be what you want. Use `ps -ef | grep ssh` to find the `process_id` (2nd column) so you can kill it with `kill ` – stwr667 Mar 21 '23 at 06:47

score 83 · Accepted Answer · edited Nov 19 '20 at 01:53

83

Update 2018

The previous answer was accurate when written, however it is now possible with some configuration to access redis cache from outside using the directions according to Accessing ElastiCache Resources from Outside AWS

Old Answer

No, you can't without resorting to 'tricks' such as a tunnel, which maybe OK for testing but will kill any real benefit of using a super-fast cache with the added latency/overhead.

The Old FAQ under How is using Amazon ElastiCache inside a VPC different from using it outside?:

An Amazon ElastiCache Cluster, inside or outside a VPC, is never allowed to be accessed from the Internet

However, this language has been removed in the current faq

edited Nov 19 '20 at 01:53

KyleMit

30,350
66
462
664

answered Feb 21 '14 at 14:32

E.J. Brennan

45,870
7
88
116

1

Is this still the case? The docs no longer say this - they claim redis is governed by standard security group policies, but I still can't get access to my redis node despite that. Strike that. Ref just moved: Amazon ElastiCache Nodes, deployed within a VPC, can never be accessed from the Internet or from EC2 Instances outside the VPC. – metalaureate Jan 29 '15 at 01:27
7

I feel that 'kill' is a bit strong. For instance we get no appreciable performance hit when running our apps outside of AWS (via such a tunnel). The tunnel's overheads are minuscule compared to DB operations, browser load, disk I/O and so on. – sming Jul 11 '16 at 18:48
1

https://docs.aws.amazon.com/AmazonElastiCache/latest/UserGuide/Access.Outside.html – CenterOrbit Feb 19 '18 at 22:29

score 28 · Answer 3 · edited Jan 08 '19 at 10:12

28

These answers are out of date.

You can access elastic-cache outside of AWS by following these steps:

Create a NAT instance in the same VPC as your cache cluster but in a public subnet.
Create security group rules for the cache cluster and NAT instance.
Validate the rules.
Add an iptables rule to the NAT instance.
Confirm that the trusted client is able to connect to the cluster.
Save the iptables configuration.

For a more detailed description see the aws guide:

https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/accessing-elasticache.html#access-from-outside-aws

edited Jan 08 '19 at 10:12

chaitan94

2,153
1
18
19

answered Apr 07 '17 at 19:08

cscan

3,684
9
45
83

I don't want a NAT instance, I want to check on it for a minute. Rico's answer is exactly what I wanted. – Pysis Jun 13 '19 at 14:51
1

how would the NAT allow access from the outside? the documentation specifies the following "Opening up the ElastiCache cluster to 0.0.0.0/0 does not expose the cluster to the Internet because it has no public IP address and therefore cannot be accessed from outside the VPC" Is there a way to allow this via NAT?? – lele Aug 23 '21 at 19:55

score 6 · Answer 4 · edited Apr 09 '20 at 16:52

6

Not so old question, I ran to the same issue myself and solved it:

Sometimes, for developing reasons you need to access from outside (to avoid multi-deployments just for a simple bug-fix maybe?)

Amazon have published a new guide that uses the EC2 as proxies for the outside world:

https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/accessing-elasticache.html#access-from-outside-aws

Good luck!

edited Apr 09 '20 at 16:52

Saransh Singh

730
4
11

answered Nov 23 '15 at 08:42

Shay Elkayam

4,128
1
22
19

3

For reference the approach Amazon mentions is a NAT instance. – russellpierce Dec 16 '15 at 00:34
FYI, from the docs: "This approach should be used for testing and development purposes only. It is not recommended for production use" – Jason Jones Dec 07 '16 at 16:28
1

Yes, that's true @jasonjonesutah I have also mentioned this in my answer. A very bad idea for production but excellent for development. – Shay Elkayam Dec 10 '16 at 14:15

score 5 · Answer 5 · answered Jul 11 '16 at 18:41

BTW if anyone wants a windows EC2 solution, try these at the DOS prompt (on said windows EC2 machine):

To Add port-forwarding

C:\Users\Administrator>netsh interface portproxy add v4tov4 listenport=6379 listenaddress=10.xxx.64.xxx connectport=6379 connectaddress=xxx.xxxxxx.ng.0001.use1.cache.amazonaws.com

To list port-forwarded ports

C:\Users\Administrator>netsh interface portproxy show all

Listen on ipv4: Connect to ipv4:

Address Port Address Port

10.xxx.128.xxx 6379 xxx.xxxxx.ng.0001.use1.cache.amazonaws.com 6379

To remove port-forwarding

C:\Users\Administrator>netsh interface portproxy delete v4tov4 listenport=6379 listenaddress=10.xxx.128.xxx

score 4 · Answer 6 · answered Oct 15 '15 at 06:53

We are using HAProxy as a reserved proxy server.

Your system outside AWS ---> Internet --> HAProxy with public IP --> Amazon Redis (Elasticache)

Notice that there is another good reason to do that (at that time)

As we use node.js client, which don't support Amazon DNS fail over, the client driver don't support dns look up again. If the redis fail, the client driver will keep connect to the old master, which is slave after failed over.

By using HAProxy, it solved that problem.

Now using the latest ioredis driver, it support amazon dns failover.

update for node.js, now ioredis support DNS fail over. If you use the DNS hostname, it can be auto fail over without HAProxy. — teddychan, Nov 02 '16 at 07:42

score 3 · Answer 7 · answered Mar 03 '16 at 20:56

This is a solid node script that will do all the dirty work for you. Tested and verified it worked.

https://www.npmjs.com/package/uzys-elasticache-tunnel

How to use Usage: uzys-elasticache-tunnel [options] [command]

Commands:

start [filename]  start tunneling with configuration file (default: config.json)
stop              stop tunneling
status            show tunneling status

Options:

-h, --help     output usage information
-V, --version  output the version number

Usage Example

start - uzys-elasticache-tunnel start ./config.json
stop - uzys-elasticache-tunnel stop
status - uzys-elasticache-tunnel status

score 1 · Answer 8 · answered Jun 30 '16 at 01:15

Its is not possible to directly access the classic-cluster from a VPC instance. The workaround would be configuring NAT on the classic instance.

NAT need to have a simple tcp proxy

YourIP=1.2.3.4
YourPort=80
TargetIP=2.3.4.5
TargetPort=22

iptables -t nat -A PREROUTING --dst $YourIP -p tcp --dport $YourPort -j DNAT \
--to-destination $TargetIP:$TargetPort
iptables -t nat -A POSTROUTING -p tcp --dst $TargetIP --dport $TargetPort -j SNAT \
--to-source $YourIP
iptables -t nat -A OUTPUT --dst $YourIP -p tcp --dport $YourPort -j DNAT \
--to-destination $TargetIP:$TargetPort

You gave the same answer in below mentioned post too, which have different requirement. How it can work in the given scenario also ?? https://stackoverflow.com/questions/38066908/connecting-to-elasticache-outside-vpc-instance-from-a-ec2-inside-vpc — abby37, Sep 11 '19 at 14:11

score 0 · Answer 9 · answered May 08 '19 at 06:37

0

I resolved using this amazon docs it says you ll have to install stunnel in your another ec2 machine.

https://aws.amazon.com/premiumsupport/knowledge-center/elasticache-connect-redis-node/

answered May 08 '19 at 06:37

Shree Prakash

2,052
2
22
33

2

this is not accessible. Could you add details here about stunnel ? – Sourabh Apr 28 '21 at 11:57