Amazon ElastiCache replication groups must not use engine default ports because default ports are easily discovered and increase the risk of automated scanning, brute-force attempts, and unauthorized access.
For AWS::ElastiCache::ReplicationGroup resources, ensure Properties.Port is not set to 6379 when Properties.Engine is redis, or to 11211 when Properties.Engine is memcached. Resources with those exact settings will be flagged.
Choose a non-default Port value if you require obscurity, but do not rely on port choice alone. Also restrict access with security groups, subnet/VPC controls, and parameter group settings.
Note that omitting the Port property typically causes the engine to use its default port. Explicitly configure a non-default port or enforce network-level restrictions to mitigate exposure.
Secure configuration example (CloudFormation YAML):
MyReplicationGroup:Type:AWS::ElastiCache::ReplicationGroupProperties:Engine:redisPort:6380ReplicationGroupId:my-redis-clusterReplicationGroupDescription:"Redis cluster on non-default port"
