ElastiCache runs Redis OSS-compatible or Valkey engines inside your VPC. Both speak the
same wire protocol — `drivers.store.kv` stays `redis`.

<Callout title="The one rule">
  Copy the **Primary Endpoint** (cluster mode disabled) from the ElastiCache console — not a replica
  reader endpoint. Use `rediss://` when encryption in transit is on.
</Callout>

## Find credentials (current console)

1. AWS Console → **ElastiCache** → **Valkey caches** or **Redis OSS caches**.
2. Click the **cluster name** (not only the radio button).
3. On the cluster detail page, copy:
   - **Primary Endpoint** (+ port, usually `6379`) for cluster-mode **disabled**
   - **Configuration Endpoint** for cluster-mode **enabled** (needs a cluster-aware
     client — oke's single-URL driver expects non-cluster / primary)
4. Auth: cluster **Connectivity** / **Auth token** (or Secrets Manager reference) —
   set at creation or rotation; there is no “password eye” identical to Redis Cloud.
5. Build `REDIS_URL` yourself:

```bash title="process env"
# Encryption in transit ON (default on many new clusters)
REDIS_URL=rediss://:AUTH_TOKEN@my-cluster.xxxxx.ng.0001.use1.cache.amazonaws.com:6379

# Transit encryption OFF
# REDIS_URL=redis://:AUTH_TOKEN@my-cluster.xxxxx.ng.0001.use1.cache.amazonaws.com:6379
```

## Production guidance

| Topic              | Guidance                                                                            |
| ------------------ | ----------------------------------------------------------------------------------- |
| Networking         | **VPC-only** — app must share VPC, peering, or PrivateLink; no public hostname      |
| Engine             | Redis OSS **or** Valkey — same `redis` driver                                       |
| Cluster mode       | Prefer **disabled** + Primary Endpoint for oke's URL-shaped client                  |
| Transit encryption | When enabled, scheme must be `rediss://`                                            |
| AUTH               | Set at create/rotate — ElastiCache does not show a Redis-Cloud-style “eye” password |

Reader endpoints exist for read scaling; oke's single `REDIS_URL` should target the
**Primary Endpoint** so writes and Gate/Signal counters hit the primary.

## Real gotcha — Redis OSS version cap

ElastiCache **Redis OSS tops out at 7.1**. Versions **7.2+ are Valkey-only**. You can
in-place upgrade Redis OSS → Valkey 7.2; planning a “Redis 7.2” engine on ElastiCache
is a category error — pick Valkey or stay ≤7.1 on Redis OSS.

## Troubleshooting

<Accordions>
<Accordion title="Connection timed out from laptop / CI">

Expected — no public endpoint. Run the app in the VPC (ECS/EKS/EC2) or use a bastion /
VPN. Security groups must allow the app SG → cache port.

</Accordion>
<Accordion title="WRONGPASS / NOAUTH after enabling AUTH">

Token not embedded in `REDIS_URL`, or still using `redis://` against a TLS-required
endpoint. Match scheme to **Encryption in-transit**, put the token after `rediss://:`.

</Accordion>
</Accordions>

## Learn more

- [Redis (image)](/docs/recipes/redis) · [Valkey (image)](/docs/recipes/valkey)
- [Memorystore](/docs/providers/memorystore) — GCP equivalent
- [Store · KV](/docs/elements/store#kv)

## Next

<Cards>
  <Card title="Memorystore" description="GCP's equivalent." href="/docs/providers/memorystore" />
  <Card
    title="Azure Cache for Redis"
    description="Azure's equivalent."
    href="/docs/providers/azure-redis"
  />
  <Card
    title="Redis Cloud"
    description="Vendor-neutral managed option."
    href="/docs/providers/redis-cloud"
  />
</Cards>