Amazon ElastiCache

A cache changes the application data path

ElastiCache manages Valkey, Redis OSS, or Memcached in memory, with sub-millisecond latency. A cache reduces database reads and latency, but the application must implement key design, TTLs, invalidation, and cache-miss handling — adding a cache is a code change, not just infrastructure.

flowchart LR
  A["Application"] --> C{"Key in<br/>cache?"}
  C -- "hit" --> X["Return value<br/>under 1 ms"]
  C -- "miss" --> D["Read database<br/>RDS"]
  D --> U["SET key, TTL 300<br/>populate cache"]
  U --> X
  W["Write path"] -. "update DB, delete or update key" .-> C
  %% step A: The application asks the cache first.
  %% step C: Most requests should be hits once the cache is warm.
  %% step X: A hit returns data from memory without touching the database.
  %% step D: On a miss, the application reads from the database as before.
  %% step U: It stores the result with a TTL so stale data expires on its own.
  %% step W: On writes, the application updates or deletes the cached key to keep data fresh.

Caching strategies

• Lazy loading (cache-aside) caches data after a read miss. Only requested data is cached and a cache failure is not fatal, but the first read is slow and data can become stale, so use TTLs and invalidation.
• Write-through updates the cache in the write path, so reads are fresh, but it caches data that may never be read and still requires failure consistency handling. Add a TTL anyway.
• Session store — keeping user sessions in the cache lets web instances remain stateless and scale out freely.

Choose keys carefully (for example user:42:profile), set TTLs per data type, and add a little random jitter to TTLs so many keys do not expire at once (a "thundering herd" on the database).

Engines

Valkey is the open-source fork of Redis supported by AWS and is usually cheaper on ElastiCache. ElastiCache Serverless removes node sizing: it scales automatically and bills by data stored and requests.

Security and placement

Place caches in private subnets, restrict Security Groups to the application SG (port 6379 for Valkey/Redis, 11211 for Memcached), and enable appropriate in-transit and at-rest encryption and authentication (AUTH token or RBAC users). IAM authentication is available for eligible Valkey and Redis OSS configurations; IAM API permissions alone do not grant data access.

Monitor CacheHitRate (or hits versus misses), Evictions (memory full), CPUUtilization / EngineCPUUtilization and CurrConnections.

Traps: adding a cache without an invalidation plan; choosing Memcached when you need failover or persistence; opening 6379 to the Internet.