Azure Cache for Redis should allow only secure connections
Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from man-in-the-middle, eavesdropping, and session-hijacking.
Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking.
What this control checks
Azure Cache for Redis must be configured to allow only secure connections
Common pitfalls
Missing block counts as a pass for this check
The check uses missing_block_result=CheckResult.PASSED, so a resource with no matching block is reported as passed.
Check inspects enable_non_ssl_port for False
The check inspects enable_non_ssl_port for a False value.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Only secure connections to your Azure Cache for Redis should be enabled" (22bee202-a82f-4305-9a2a-6d7f44d4dedb) and "Configure Azure Cache for Redis to disable non SSL ports" (766f5de3-c6c0-4327-9f4d-042ab8ae846c); PowerPipe control azure_compliance.control.redis_cache_ssl_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_91; KICS query "Redis Cache Allows Non SSL Connections" (e29a75e6-aba3-4896-b42d-b87818c16b58).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
- 0810.01n2Organizational.5-01.n 01.04 Network Access Control
- 0811.01n2Organizational.6-01.n 01.04 Network Access Control
- 0812.01n2Organizational.8-01.n 01.04 Network Access Control
- 0814.01n1Organizational.12-01.n 01.04 Network Access Control
1 more clause
- 1451.05iCSPOrganizational.2-05.i 05.02 External Parties
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
redis_cache_ssl_enabled - Checkov Check:
CKV_AZURE_91 - Powerpipe Control:
azure_compliance.control.redis_cache_ssl_enabled - Azure Policy Definitions:
22bee202-a82f-4305-9a2a-6d7f44d4dedb,766f5de3-c6c0-4327-9f4d-042ab8ae846c - KICS Query:
e29a75e6-aba3-4896-b42d-b87818c16b58
Last reviewed: 2026-10-14