🟧 AWS MemoryDB Terraform Module

A secure-by-default Amazon MemoryDB cluster — a durable, in-memory database for Redis/Valkey workloads — always encrypted at rest, always TLS-required in transit, RBAC-gated through a named ACL, and snapshot-backed, delivering the cluster, its subnet group, parameter group, RBAC users, and ACL from a single composite call. Built for the AWS provider v6.x.

• ⚡ Provisions an Amazon MemoryDB cluster — the keystone is aws_memorydb_cluster.this. Unlike ElastiCache, MemoryDB is a durable primary database: writes are persisted to a Multi-AZ transactional log, so it can be a system of record, not just a cache.
• 🌐 Owns the subnet group (<name>-subnets, private subnets, ≥ 2 AZs for a multi-shard / multi-replica topology) so a single call yields a complete, private placement.
• 👥 Optionally creates RBAC users (aws_memorydb_user) as a for_each map keyed by user_id, bundled into a module-created named ACL (aws_memorydb_acl) and bound to the cluster — the secure path that replaces the discouraged built-in open-access ACL.
• 🎛️ Optionally creates a dedicated parameter group (<name>-params) for engine tuning (maxmemory-policy, etc.).
• 🔒 Secure by default: at-rest encryption is always on (AWS-managed key, or a caller CMK), in-transit TLS is always on and cannot be disabled, access defaults to a named RBAC ACL (never open-access), one replica per shard for automatic failover, and 7-day snapshot retention.
• 🧩 Consumes networking, security, and KMS by reference — it never creates a VPC, security group, or KMS key itself; secrets (RBAC passwords) are referenced from Secrets Manager rather than inlined.

💡 Why it matters: Because MemoryDB is durable, it frequently holds the authoritative copy of session state, tokens, and cached PII under privacy-regulation — the blast radius of a misconfigured cluster is larger than a throwaway cache. This module ships locked down (mandatory encryption, mandatory TLS, RBAC ACL) and makes you opt out of the few relaxable defaults explicitly.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

flowchart LR
 VPC["terraform-aws-vpc"]
 SG["terraform-aws-security-group"]
 KMS["terraform-aws-kms"]
 SM["terraform-aws-secrets-manager"]
 MDB["terraform-aws-memorydb"]
 APP["Application tier<br/>(ECS / EKS / EC2)"]

 VPC -->|subnet_ids| MDB
 SG -->|security_group_ids| MDB
 KMS -->|kms_key_arn| MDB
 SM -->|RBAC user passwords| MDB
 MDB -->|cluster configuration endpoint| APP

 style MDB fill:#FF9900,color:#fff

MemoryDB sits at the durable data tier. It is downstream of the networking, security-group, and KMS foundations and upstream of the application tier that connects to its cluster (configuration) endpoint. Secrets Manager supplies RBAC user passwords.

flowchart TD
 subgraph caller["Caller-supplied (by reference)"]
 SUBNETS["subnet_ids<br/>(terraform-aws-vpc)"]
 SGS["security_group_ids<br/>(terraform-aws-security-group)"]
 CMK["kms_key_arn<br/>(terraform-aws-kms)"]
 SECRET["user passwords<br/>(terraform-aws-secrets-manager)"]
 end

 subgraph mod["terraform-aws-memorydb"]
 SUB["aws_memorydb_subnet_group.this"]
 PG["aws_memorydb_parameter_group.this<br/>(optional)"]
 U["aws_memorydb_user.this<br/>for_each — RBAC users"]
 ACL["aws_memorydb_acl.this<br/>(optional, binds users)"]
 CL["aws_memorydb_cluster.this<br/>keystone"]
 end

 SUBNETS --> SUB
 SUB --> CL
 PG --> CL
 SGS --> CL
 CMK --> CL
 SECRET --> U
 U --> ACL
 ACL --> CL

 style CL fill:#FF9900,color:#fff

No provider {} block is declared inside the module — it inherits the caller's configured provider (and credential chain / Region). See the AWS Prerequisites Region note below.

The Terraform identity needs the following (least-privilege). RBAC, ACL, parameter-group, and KMS actions are needed only when their respective features are configured.

⚠️ Scope the resource ARNs in your policy to arn:aws:memorydb:<region>:<account>:cluster/* / :subnetgroup/* / :parametergroup/* / :user/* / :acl/* patterns rather than "*" where your governance allows.

• Service-linked role: AWSServiceRoleForMemoryDB is auto-created on first MemoryDB use (iam:CreateServiceLinkedRole). It lets the service manage ENIs and resources inside your VPC.
• Networking: the supplied subnet_ids must be private (MemoryDB has no public endpoint — PII/privacy-regulation baseline) and span at least two Availability Zones for any multi-shard or multi-replica cluster (the default is one replica per shard). The security groups must allow the cluster port (6379 by default) from the application security group only — never 0.0.0.0/0.
• Mandatory at-rest encryption: MemoryDB is always encrypted at rest — there is no toggle. Supplying kms_key_arn selects a customer-managed key; omitting it uses the AWS-managed key. A CMK's key policy must allow the MemoryDB service principal (memorydb.amazonaws.com) the standard kms:Encrypt/Decrypt/GenerateDataKey*/CreateGrant set. Changing kms_key_arn is FORCE-NEW.
• Mandatory in-transit encryption (TLS): unlike ElastiCache, MemoryDB cannot disable TLS — it is always on. RBAC therefore always operates over an encrypted channel.
• ACL required: every cluster must reference an ACL. The built-in open-access ACL disables RBAC and is strongly discouraged for PII/privacy-regulation workloads — define RBAC users via users and let the module create a named ACL (acl). Provide exactly one of acl or acl_name.
• Engine / node availability: the chosen engine (redis/valkey), engine_version, and node_type must be offered in the target Region. MemoryDB uses the db.* node family (e.g. db.t4g.small, db.r7g.large), not the ElastiCache cache.* family. data_tiering = true requires an r6gd node type.
• Region model: the module relies on provider inheritance — there is no region variable. The caller's provider block (or alias) sets the Region. MemoryDB is a regional service — no us-east-1 global-service constraint applies.
• Service quotas: default soft limits on nodes/clusters per Region, all raisable via Service Quotas. A ClusterQuotaForCustomerExceededFault indicates the per-account cluster quota was hit.

terraform-aws-memorydb/
├── providers.tf # terraform{} + required_providers (aws >= 6.0, < 7.0); no provider{} block
├── variables.tf # typed inputs: identity → required → optional → tags → timeouts
├── main.tf # subnet group, parameter group, RBAC users, ACL, cluster (this)
├── outputs.tf # id + arn, endpoints, RBAC/ACL maps, subnet/parameter group, tags_all
├── SCOPE.md # boundary, IAM, prerequisites, gotchas, secure defaults
└── README.md # this file

The smallest working call — networking, security, and RBAC wired from upstream modules:

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-core-mdb"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]

  users = {
    app-rw = {
      user_name     = "app-rw"
      access_string = "on ~* &* +@all"
      authentication_mode = {
        type      = "password"
        passwords = [data.aws_secretsmanager_secret_version.app_rw.secret_string] # sensitive
      }
    }
  }
  acl = {} # module creates `<name>-acl` and binds the users above

  tags = {
    Environment = "prod"
    DataClass   = "PII"
    CostCenter  = "platform-data"
  }
}

Everything not shown inherits the secure baseline: at-rest encryption on (always), TLS on (always), one replica per shard for automatic failover, and 7-day snapshot retention.

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-min"
  node_type          = "db.t4g.small"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]

  users = {
    app = {
      user_name     = "app"
      access_string = "on ~* &* +@all"
      authentication_mode = {
        type      = "password"
        passwords = [data.aws_secretsmanager_secret_version.app.secret_string]
      }
    }
  }
  acl = {} # creates `casey-mdb-min-acl`
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-cmk"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]

  kms_key_arn = module.kms.arn # auditable, independently-revocable CMK

  acl_name = "open-access" # (shown for brevity; prefer a named ACL — see example 1)
}

# Provider-level default_tags is the CALLER's concern (root module / pipeline):
provider "aws" {
  default_tags { tags = { ManagedBy = "terraform", Org = "" } }
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-tagged"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]
  acl_name           = "open-access"

  tags = {
    Environment = "prod"
    DataClass   = "PII"
    Org         = "-Data" # resource tag wins over default_tags on key conflict
  }
}
# module.memorydb.tags_all => { ManagedBy, Org=-Data, Environment, DataClass }

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-sharded"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids # 3 AZs
  security_group_ids = [module.mdb_sg.id]

  num_shards             = 3
  num_replicas_per_shard = 2 # 3 shards × (1 primary + 2 replicas) = 9 nodes

  acl = {}
  users = {
    app = {
      user_name           = "app"
      access_string       = "on ~* &* +@all"
      authentication_mode = { type = "password", passwords = [data.aws_secretsmanager_secret_version.app.secret_string] }
    }
  }
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-rbac"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]

  users = {
    app-rw = {
      user_name           = "app-rw"
      access_string       = "on ~* &* +@all"
      authentication_mode = { type = "password", passwords = [data.aws_secretsmanager_secret_version.app_rw.secret_string] }
    }
    app-ro = {
      user_name           = "app-ro"
      access_string       = "on ~* &* +@read"
      authentication_mode = { type = "password", passwords = [data.aws_secretsmanager_secret_version.app_ro.secret_string] }
    }
  }

  acl = {
    name       = "casey-mdb-rbac-acl"
    user_names = ["audit-readonly"] # externally-managed user, added alongside module users
  }
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-iamauth"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]

  users = {
    app = {
      user_name           = "app"
      access_string       = "on ~* &* +@all"
      authentication_mode = { type = "iam" } # no passwords — auth via IAM
    }
  }
  acl = {}
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-params"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]
  acl                = {}

  parameter_group = {
    family      = "memorydb_redis7"
    description = "MemoryDB Redis 7 tuned parameters"
    parameters = {
      "maxmemory-policy" = "allkeys-lru"
    }
  }
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-valkey"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]

  engine          = "valkey"
  engine_version  = "7.3"
  acl             = {}
  parameter_group = { family = "memorydb_valkey7" }
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-backups"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]
  acl                = {}

  snapshot_retention_limit = 35
  snapshot_window          = "04:00-05:00"         # UTC
  maintenance_window       = "sun:05:30-sun:06:30" # UTC
  final_snapshot_name      = "casey-mdb-backups-final"
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-restored"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]
  acl                = {}

  snapshot_name = "casey-core-mdb-2026-06-18" # FORCE-NEW; or seed from S3 via snapshot_arns
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-notify"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]
  acl                = {}

  sns_topic_arn              = module.mdb_events_topic.arn # app-integration module
  auto_minor_version_upgrade = true                        # default
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-extacl"
  node_type          = "db.r7g.large"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]

  # No `acl` / `users` here — bind to an ACL managed elsewhere:
  acl_name = "platform-shared-acl"
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-mdb-dev"
  node_type          = "db.t4g.small"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]
  acl                = {}

  # OPT-OUTS — dev only, never in prod / PII:
  num_replicas_per_shard   = 0 # single node per shard, no automatic failover
  snapshot_retention_limit = 0 # disables automatic snapshots

  tags = { Environment = "dev", DataClass = "synthetic" }
}

module "vpc" {
  source   = "git::https://github.com/microsoftexpert/terraform-aws-vpc?ref=v1.0.0"
  name     = "casey-data"
  vpc_cidr = "10.40.0.0/16"
  #... produces private_subnet_ids across 3 AZs
}

module "kms" {
  source      = "git::https://github.com/microsoftexpert/terraform-aws-kms?ref=v1.0.0"
  description = "CMK for MemoryDB at-rest encryption"
  alias       = "alias/casey-mdb"
}

module "mdb_sg" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-security-group?ref=v1.0.0"
  name   = "casey-mdb-sg"
  vpc_id = module.vpc.id

  ingress_rules = {
    memorydb = {
      from_port                    = 6379
      to_port                      = 6379
      ip_protocol                  = "tcp"
      referenced_security_group_id = module.app_sg.id # app tier only — never 0.0.0.0/0
      description                  = "MemoryDB from application tier"
    }
  }
}

data "aws_secretsmanager_secret_version" "mdb_app" {
  secret_id = "casey/memorydb/app-rw"
}

module "memorydb" {
  source = "git::https://github.com/microsoftexpert/terraform-aws-memorydb?ref=v1.0.0"

  name               = "casey-core-mdb"
  node_type          = "db.r7g.large"
  engine             = "redis"
  engine_version     = "7.1"
  subnet_ids         = module.vpc.private_subnet_ids
  security_group_ids = [module.mdb_sg.id]

  kms_key_arn = module.kms.arn

  num_shards             = 2
  num_replicas_per_shard = 1

  users = {
    app-rw = {
      user_name           = "app-rw"
      access_string       = "on ~* &* +@all"
      authentication_mode = { type = "password", passwords = [data.aws_secretsmanager_secret_version.mdb_app.secret_string] }
    }
  }
  acl = { name = "casey-core-mdb-acl" }

  snapshot_retention_limit = 14
  final_snapshot_name      = "casey-core-mdb-final"

  tags = {
    Environment = "prod"
    DataClass   = "PII"
    Compliance  = "privacy-regulation"
  }
}

output "mdb_endpoint" { value = module.memorydb.cluster_endpoint_address }
output "mdb_arn" { value = module.memorydb.arn }

ℹ️ Full type schemas and per-field descriptions live in variables.tf;

See the Emits table above. Primary outputs are id and arn; connectivity is exposed as cluster_endpoint_address / cluster_endpoint_port; shard topology as shards; RBAC/ACL data as acl_name / acl_arn / user_arns; the module-created groups as subnet_group_name/_arn and parameter_group_name/_arn; tags_all reflects the merged tag set. No secret is emitted — RBAC passwords are referenced from Secrets Manager, never output.

• ARN / ID formats.
• Cluster arn: arn:aws:memorydb:<region>:<account>:cluster/<name>; id = the cluster name.
• Subnet group arn: :subnetgroup/<name>-subnets; parameter group arn: :parametergroup/<name>-params; RBAC user arn: :user/<user_name>; ACL arn: :acl/<name>-acl.
• Durable, not a cache. MemoryDB persists writes to a Multi-AZ transactional log, so it can be a primary database. This is why the secure posture (mandatory encryption + TLS, RBAC ACL, snapshots, ≥1 replica) is enforced more tightly than terraform-aws-elasticache.
• FORCE-NEW (immutable) fields. name, subnet_group_name membership, port, kms_key_arn, network_type, data_tiering, auto_minor_version_upgrade, tls_enabled, an engine-version downgrade, and snapshot_arns/snapshot_name all destroy-and-recreate the cluster (and its data). The module-created parameter group and ACL use create_before_destroy so family/membership changes don't deadlock.
• Encryption and TLS are mandatory. Unlike ElastiCache there is no at_rest_encryption_enabled toggle and no way to turn TLS off — kms_key_arn only chooses which key encrypts at rest (CMK vs AWS-managed). tls_enabled defaults to true and the service requires it for RBAC.
• ACL coupling. The cluster's acl_name must reference an existing ACL. The module computes effective_acl_name from the module-created aws_memorydb_acl.this (when acl is set) or the external acl_name, and the ACL's membership is the union of every aws_memorydb_user.this plus acl.user_names. Create users and the ACL before/alongside the cluster — the dependency graph orders this.
• tags ↔ tags_all ↔ default_tags. The module sets only resource-level tags (merged with per-item tags on users/ACL via merge(var.tags, try(each.value.tags, {}))). The provider's default_tags is the caller's concern (never set inside a module). On a key collision the resource tag wins. tags_all (output) is the computed union AWS actually applied — use it for drift checks and audit.
• Eventual consistency. Cluster and node creation is asynchronous and can take many minutes; the cluster_endpoint_address is a stable DNS name that follows failover, so applications should resolve it at connect time rather than caching IPs.
• Destroy ordering. Terraform tears down the cluster → ACL → users / parameter group / subnet group. A subnet group, parameter group, or ACL cannot be deleted while the cluster still references it; the dependency graph normally orders this, but a half-failed destroy can leave a group/ACL pinned by a lingering cluster. With final_snapshot_name set, a final snapshot is taken before deletion. The service-managed ENIs are cleaned up by the SLR — there are no NAT/ENI destroy hazards to manage directly.
• No us-east-1 constraint. MemoryDB is a regional service — none of the us-east-1 global-service rules (CloudFront/WAF/ACM) apply. Rely on provider inheritance for the Region.

Secure by default; every weakening is an explicit, documented opt-out.

Other principles: exactly four .tf files; one keystone named this; child collections (users, ACL, parameter group) via for_each over map(object) (never count); deeply-typed object schemas with optional defaults; validation {} on every closed value set (engine, network_type, ip_discovery, authentication_mode.type, snapshot/replica ranges); no credential or region variables; secrets referenced not stored; primary outputs id + arn; tags_all surfaced.

# Validate (no credentials needed)
terraform init -backend=false
terraform validate
terraform fmt -check

# Plan / apply (requires AWS credentials + Region)
# credentials via AWS_PROFILE / SSO / OIDC; Region via the provider block
terraform plan -out tfplan
terraform apply tfplan

plan/apply require a valid credential chain (profile / SSO / OIDC web-identity) and a configured Region. The module declares no provider {} block — supply it (and any assume_role) at the root. Cluster creation can take several minutes; raise timeouts.create for large sharded topologies.

⚠️ Always pin the module source with ?ref=v1.0.0 — never a branch.

• terraform init -backend=false && terraform validate — schema and reference integrity.
• terraform fmt -check — canonical formatting.
• terraform plan against a sandbox account — confirm the secure defaults render (at-rest encryption + TLS on, one replica per shard, 7-day snapshots) and that the ACL is the module-created named ACL rather than open-access.
• Post-apply smoke test: connect over TLS from an in-VPC host to the cluster_endpoint_address on 6379, authenticate with an RBAC user, and run PING / INFO replication.

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

Outputs:

arn = "arn:aws:memorydb:us-east-2:123456789012:cluster/casey-core-mdb"
id = "casey-core-mdb"
mdb_endpoint = "clustercfg.casey-core-mdb.abc123.memorydb.us-east-2.amazonaws.com"
acl_name = "casey-core-mdb-acl"

• Amazon MemoryDB Developer Guide
• Getting started with MemoryDB
• Accessing your MemoryDB cluster
• Authenticating with RBAC and ACLs (MemoryDB)
• Using service-linked roles for MemoryDB
• Terraform aws_memorydb_cluster
• Terraform aws_memorydb_acl
• Terraform aws_memorydb_user
• Module SCOPE.md — boundary, IAM, prerequisites, gotchas
• Upstream: terraform-aws-vpc, terraform-aws-security-group, terraform-aws-kms, terraform-aws-secrets-manager

🧡 "Infrastructure as Code should be standardized, consistent, and secure."