Redis Cache must disable non-SSL port

High Azure General redis-redis-cache-disable-non-ssl

Applies to

Microsoft.Cache/redis

What CGPulse checks

A resource passes this rule when enableNonSslPort must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Disable the non-SSL port to encrypt all connections and protect cached data. In Azure Portal: Redis Cache > Advanced settings > set Allow access only via SSL to Yes. See: https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-configure#access-ports

Careful: Disabling non-SSL port breaks applications connecting on port 6379 without TLS. Verify all clients use SSL

CLI

az redis update --ids "{id}" --set enableNonSslPort=false

Terraform

resource "azurerm_redis_cache" "{name}" {
  name                     = "{name}"
  resource_group_name      = "{rg}"
  location                 = var.location
  capacity                 = 0
  family                   = "C"
  sku_name                 = "Basic"
  non_ssl_port_enabled     = false
  # Match sku to your Redis tier (Basic/Standard/Premium)
}

Compliance frameworks

Cloud Security BaselineDP-3
Critical Security Controls v84.8
GDPR: Data Protection Controls
HIPAA: Health Information Protection164.312(e)(1)
NIST 800-53: Cloud Security ControlsSC-8
PCI DSS v4.04.2.1
Well-Architected Cloud Review

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan