aws elasticcache for redis 基本概念和访问控制

基本概念

集群，一个或多个缓存节点的集合，创建集群时需要指定节点的引擎和版本。每个redis引擎版本都有对应的参数组

集群的计算和内存容量由实例、节点或类决定

集群节点存储有两种类型：标准和内存优化

• 节点，固定大小与网络连接的安全 RAM 区块（可选择引擎和版本）。集群中的每个节点都是相同的实例类型且运行相同的缓存引擎，每个缓存节点都有自己的域名服务 (DNS) 名称和端口
• 分片（节点组），1 到 6 个相关节点的分组，redis（禁用集群模式）集群始终有一个分片。最多可以有500个分片（5.0.6或更高版本），5.0.6以下的版本，每个集群的限制是250个。可以选择配置一个500个节点集群，该集群的范围在83个分片(每个分片中，一个节点是读/写主节点，其他节点是只读副本节点)和500个分片(单个主要副本和没有副本)之间。

• 槽（slot）可以根据分片进行划分

• 集群，一个或多个 redis 分片的逻辑分组。

• 复制，通过在一个分片（cli中的节点组）中从两个节点到六个节点的分组实现。副本节点维护主节点数据副本，使用异步复制机制与主节点保持同步。副本只提供读功能

• 终端节点endpoint，应用程序连接到节点或集群的唯一地址

  • 单节点endpoint（禁用集群模式）：单个endpoint（读和写）
  • 多节点endpoint（禁用集群模式）：主节点endpoint和只读节点endpoint
  • redis（启用集群模式）endpoint：提供配置终端端点，应用程序通过配置端点发现主端点和读端点

• 参数组，对集群引擎运行时进行额外配置的方法，控制内存使用、驱逐策略、项大小等

• 安全访问，通过安全组和子网组限制特定ec2实例的应用程序访问redis，还支持tls传输中加密

• 备份，取决于redis版本，备份进程需要额外的预留内存以成功运行

集群的访问控制

默认情况下，对您的集群的网络访问权限仅限于用于创建集群的用户账户，必须先授权 EC2 实例访问集群，然后您才能从 EC2 实例连接到集群

查找redis集群终端节点

复制组和节点组的区别，主要感觉使用方式上的区别

$ aws elasticache describe-replication-groups 
ReplicationGroups:
- ARN: arn:aws-cn:elasticache:cn-north-1:xxxxxxxx:replicationgroup:myredis-nocluster
  AtRestEncryptionEnabled: false
  AuthTokenEnabled: false
  AutoMinorVersionUpgrade: true
  AutomaticFailover: enabled
  CacheNodeType: cache.t3.medium
  ClusterEnabled: false
  Description: ' '
  GlobalReplicationGroupInfo: {}
  IpDiscovery: ipv4
  LogDeliveryConfigurations:
  - DestinationDetails:
      CloudWatchLogsDetails:
        LogGroup: redisslow
    DestinationType: cloudwatch-logs
    LogFormat: json
    LogType: slow-log
    Status: active
  - DestinationDetails:
      CloudWatchLogsDetails:
        LogGroup: redisengine
    DestinationType: cloudwatch-logs
    LogFormat: json
    LogType: engine-log
    Status: active
  MemberClusters:
  - myredis-nocluster-001
  - myredis-nocluster-002
  - myredis-nocluster-003
  MultiAZ: enabled
  NetworkType: ipv4
  NodeGroups:
  - NodeGroupId: '0001'
    NodeGroupMembers:
    - CacheClusterId: myredis-nocluster-001
      CacheNodeId: '0001'
      CurrentRole: primary
      PreferredAvailabilityZone: cn-north-1b
      ReadEndpoint:
        Address: myredis-nocluster-001.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn
        Port: 6379
    - CacheClusterId: myredis-nocluster-002
      CacheNodeId: '0001'
      CurrentRole: replica
      PreferredAvailabilityZone: cn-north-1b
      ReadEndpoint:
        Address: myredis-nocluster-002.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn
        Port: 6379
    - CacheClusterId: myredis-nocluster-003
      CacheNodeId: '0001'
      CurrentRole: replica
      PreferredAvailabilityZone: cn-north-1a
      ReadEndpoint:
        Address: myredis-nocluster-003.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn
        Port: 6379
    PrimaryEndpoint:
      Address: master.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn
      Port: 6379
    ReaderEndpoint:
      Address: replica.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn
      Port: 6379
    Status: available
  PendingModifiedValues: {}
  ReplicationGroupCreateTime: 'xxxx-xx-xxT06:55:40.911000+00:00'
  ReplicationGroupId: myredis-nocluster
  SnapshotRetentionLimit: 0
  SnapshotWindow: 15:00-16:00
  Status: available
  TransitEncryptionEnabled: true
  
$ aws elasticache describe-cache-clusters  --cache-cluster-id myredis-nocluster-001  --show-cache-node-info
CacheClusters:
- ARN: arn:aws-cn:elasticache:cn-north-1:xxxxxxxx:cluster:myredis-nocluster-001
  AtRestEncryptionEnabled: false
  AuthTokenEnabled: false
  AutoMinorVersionUpgrade: true
  CacheClusterCreateTime: 'xxxx-xx-xxT07:01:52.251000+00:00'
  CacheClusterId: myredis-nocluster-001
  CacheClusterStatus: available
  CacheNodeType: cache.t3.medium
  CacheNodes:
  - CacheNodeCreateTime: 'xxxx-xx-xxT07:01:52.251000+00:00'
    CacheNodeId: '0001'
    CacheNodeStatus: available
    CustomerAvailabilityZone: cn-north-1b
    Endpoint:
      Address: myredis-nocluster-001.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn
      Port: 6379
    ParameterGroupStatus: in-sync
  CacheParameterGroup:
    CacheNodeIdsToReboot: []
    CacheParameterGroupName: default.redis6.x
    ParameterApplyStatus: in-sync
  CacheSecurityGroups: []
  CacheSubnetGroupName: mysubnetgroup
  ClientDownloadLandingPage: 'https://console.aws.amazon.com/elasticache/home#client-download:'
  Engine: redis
  EngineVersion: 6.2.6
  IpDiscovery: ipv4
  LogDeliveryConfigurations: []
  NetworkType: ipv4
  NumCacheNodes: 1
  PendingModifiedValues: {}
  PreferredAvailabilityZone: cn-north-1b
  PreferredMaintenanceWindow: sun:17:00-sun:18:00
  ReplicationGroupId: myredis-nocluster
  ReplicationGroupLogDeliveryEnabled: true
  SecurityGroups:
  - SecurityGroupId: sg-096df1a0cb9a6d7e9
    Status: active
  SnapshotRetentionLimit: 0
  SnapshotWindow: 15:00-16:00
  TransitEncryptionEnabled: true

If a Redis (cluster mode disabled) cluster has only one node, the node’s endpoint is used for both reads and writes. If the cluster has multiple nodes, there are three types of endpoints; the primary endpoint, the reader endpoint and the node endpoints.

编译安装客户端

sudo amazon-linux-extras install epel -y
sudo yum install gcc jemalloc-devel openssl-devel tcl tcl-devel -y
sudo wget http://download.redis.io/redis-stable.tar.gz
sudo tar xvzf redis-stable.tar.gz
cd redis-stable
sudo make BUILD_TLS=yes # BUILD_TLS=yes 在redis-cli编译时启用SSL/TLS

连接redis集群，默认情况下redis-cli 在连接到 Redis 时使用未加密的 TCP 连接

# 禁用集群模式，仅启用加密
$ redis-cli -h master.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn --tls -p 6379
# 禁用集群模式，启用加密和身份验证
$ redis-cli -h master.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn --tls -p 6379 -a your-password
# 启用集群模式，仅启用加密
$ redis-cli -c -h master.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn --tls -p 6379 
# 启用集群模式，启用加密和身份验证
$ redis-cli -c -h master.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn --tls -p 6379 -a your-password

单纯测试连接

$ telnet master.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn 6379
$ openssl s_client -connect master.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn:6379
CONNECTED(00000003)
depth=2 C = US, O = Amazon, CN = Amazon Root CA 1
verify return:1
depth=1 C = US, O = Amazon, CN = Amazon RSA 2048 M01
verify return:1
depth=0 CN = *.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn
verify return:1
---
Certificate chain
 0 s:/CN=*.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn
   i:/C=US/O=Amazon/CN=Amazon RSA 2048 M01
 1 s:/C=US/O=Amazon/CN=Amazon RSA 2048 M01
   i:/C=US/O=Amazon/CN=Amazon Root CA 1
 2 s:/C=US/O=Amazon/CN=Amazon Root CA 1
   i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Services Root Certificate Authority - G2
 3 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Services Root Certificate Authority - G2
   i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxqhkiG9w0BAQsFADA8
MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRwwGgYDVQQDExNBbWF6b24g
UlNBIDIwNDggTTAxMB4XDTIyMTIyNzAwMDAwMFoXDTI0MDEyNjIzNTk1OVowQTE/
MD0GA1UEAww2Ki5teXJlZGlzLW5vY2x1c3Rlci5nZ3F1Z3EuY25uMS5jYWNoZS5h
bWF6b25hd3MuY29tLmNuMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
hTFAG/Q4UxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxS4qswN/sh
Xd94AlqcrHJ/H/02gfiPOxdL69+9dPSWZzl2GenSoGVKAtj0+90teHdUQqjG9bpE
s/lsFomYdG/MzgSscpGux5RTJ/MkVLcFoMvvt1/1rhxjp4I33vV0bEJEiVBwBdQu
jY8wIKj29zM30V9T+VcmNRM6sekjYXPhU56Fn6MNymYgozIag8vQP1qZ8ueLjz3p
zvufKxyW2JU1MrU111lxmQ7pYOK0mqbFifTFkjSwVafbyWCGTrzo7zaK3eeHZUnj
EyEQDX8YjlNInZ2Q5uGNSwIDAQABo4IBjTCCAYkwHwYDVR0jBBgwFoAUgbgOY4qJ
Ehjl+js7UJWf5uWQE4UwHQYDVR0OBBYEFEugKaMmSen0njgLWi9vdqVXPLGGMEEG
A1UdEQQ6MDiCNioubXlyZWRpcy1ub2NsdXN0ZXIuZ2dxdWdxLmNubjEuY2FjaGUu
YW1hem9uYXdzLmNvbS5jbjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYB
BQUHAwEGCCsGAQUFBwMCMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9jcmwucjJt
MDEuYW1hem9udHJ1c3QuY29tL3IybTAxLmNybDATBgNVHSAEDDAKMAgGBmeBDAEC
ATB1BggrBgEFBQcBAQRpMGcwLQYIKwYBBQUHMAGGIWh0dHA6Ly9vY3NwLnIybTAx
LmFtYXpvbnRydXN0LmNvbTA2BggrBgEFBQcwAoYqaHR0cDovL2NydC5yMm0wMS5h
bWF6b250cnVzdC5jb20vcjJtMDEuY2VyMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN
AQELBQADggEBABdbUsyS0FE6/2hYuGoP01rx01Ca1NxpgUsck6Fu1aewqyxXeNhO
ZM9lVNV7AmgjVLUiZkICehD7FHDblupzd0TQdaqVPrfeZKdH8rJvTTQYlauIc46H
YNgDsE+NrEwjZUY4X63XxLA0kZA+ha925TgWgYahG4C5+PVf+3lDow9za3jTSe88
+UxF1Kt8i3KRaNaW5aIrUpx313zJN9JCdVMON0JzXUv9Jn/ryMEaaHbLHB1Es7Mo
JexzQkSnuCoQ4qjGn/pEnAHI3qUuqYgGG6uJFz+Wm3fIXDY2oSGNcGhip16neB4k
MT5AqZZkjak7GkF9yWtFDjsCk9TBuIdSsVk=
-----END CERTIFICATE-----
subject=/CN=*.myredis-nocluster.xxxxxxxx.cnn1.cache.amazonaws.com.cn
issuer=/C=US/O=Amazon/CN=Amazon RSA 2048 M01
---
No client certificate CA names sent
Peer signing digest: SHA256
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 5148 bytes and written 415 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: xxxxxxxxxxxxxxxCB6531E63A47046EFFFFFBA9A5747566739C1CDD2BA41ACDA
    Session-ID-ctx:
    Master-Key: 6xxxxxxxxxxxxxxxxx16D39174B1AB82718C8B695F59553C2190153442AE76E35142D1FCB8C
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1672127040
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
Auth your-password

开启传输中加密之后有三种访问控制

• 默认不进行访问控制

• redis AUTH 默认用户访问

• 用户组访问控制列表

$ redis-cli -h master.myredis-nocluster-auth.xxxxxx.cnn1.cache.amazonaws.com.cn --tls -p 6379
master.myredis-nocluster-auth.xxxxxxxx.cnn1.cache.amazonaws.com.cn:6379> ping
(error) NOAUTH Authentication required.
master.myredis-nocluster-auth.xxxxxxx.cnn1.cache.amazonaws.com.cn:6379> auth xxxxxxxxx
OK
// 关闭server之后连接关闭
master.myredis-nocluster-auth.xxxxxxx.cnn1.cache.amazonaws.com.cn:6379> ping
Error: Broken pipe