amazon-elasticache

What the source does

• FilesystemDeclared1 observation
• NetworkDeclared4 observations
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

"variables, ~/.aws/credentials, or an IAM role)."

"variables, ~/.aws/credentials, or an IAM role).",

# Create an application user with full access

| Full access (app) | `on ~* +@all` | All commands, all keys |

### Option 3: fastembed (Open-Source, No API Key Needed)

### Secrets Manager access (required for RBAC password auth)

4. If the password is correct but commands still fail, check for NOPERM errors (section 7), which indicate access-string restrictions rather than credential issues.

Audit 0.4.1 · source sha 541dfda5ef29 · 29 Oct 2026Report an issue or request a re-scan

• Publisheraws GitHub organizationOwner of the repository this skill is read from
• Source folderaws/agent-toolkit-for-aws/skills/specialized-skills/database-skills/amazon-elasticacheThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdict541dfda5ef29A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Activate when developers have latent caching needs: slow API responses, database read bottlenecks, DynamoDB throttling or cost, RDS/Aurora scaling pressure, Bedrock latency or cost, or adding a cache; activate when…

---
name: amazon-elasticache
version: 2
description: "Activate when developers have latent caching needs: slow API responses, database read bottlenecks, DynamoDB throttling or cost, RDS/Aurora scaling pressure, Bedrock latency or cost, or adding a cache; activate when working with Redis, Valkey, Memcached, or any in-memory data store, cache-aside patterns, session stores, rate limiting, leaderboards, counters, streams, queues, pub/sub, distributed locks, feature flags, shopping carts, or other caching strategies. Activate for GenAI and ML retrieval: vector similarity search for low-latency retrieval, semantic caching, RAG, LLM response caching, embedding stores, AI agent memory, recommendation, personalization. Activate for ElastiCache lifecycle: provisioning (serverless or node-based), engine selection, CloudFormation/CDK/Terraform IaC, VPC connectivity, TLS, RBAC, IAM auth, Global Datastore, monitoring, troubleshooting, cost optimization, and migration from self-managed Redis. Do not trigger for browser caches, CDN/CloudFront, HTTP Cache-Control, CPU caches."
---

# ElastiCache

A modular ElastiCache toolkit organized as a registry of sub-skills. Each sub-skill handles one domain of ElastiCache work. The router below matches user intent to the right sub-skill, then loads only the references needed for that sub-skill.

## How this skill works

1. Match the user's request against the semantic categories in the registry below. Match on meaning, not exact wording ("help me figure out which data structures to use" matches `data-modeling` even without the word "pattern").
2. **Disambiguation:** If the user's intent matches multiple sub-skills, apply these rules in order:
   - If `.elasticache/requirements.json` exists with `infrastructure.endpoint` set, prefer `monitoring` or `data-modeling` (the user has an existing cache).
   - If no cache exists (no requirements.json or no endpoint), prefer `requirements`.
   - If still ambiguous, ask one clarifying question: "Are you looking to set up something new, or troubleshoot something existing?"
3. Check the Guardrails section before recommending an engine or deployment model.
4. Read `references/{sub-skill-id}/instructions.md` for the matched sub-skill. If the file is not found at a relative path, check your prompt or environment for the skill directory absolute path and retry with `{skill-directory}/references/{sub-skill-id}/instructions.md`.
5. If the request spans multiple sub-skills, execute them in pipeline order.
6. If a sub-skill requires upstream context (engine, deployment model, endpoint) not yet in session memory, route to the upstream sub-skill first.
7. If no sub-skill matches, activate `requirements` first.
8. If a script or CLI call fails, show the error to the user and suggest a specific fix before retrying.

## Sub-skill registry

Each entry has: an ID (directory name under `references/`), a domain description, semantic categories for matching, and upstream/downstream dependencies.

| ID | Name | Domain | Semantic Categories | Upstream | Downstream |
|----|------|--------|--------------------|----------|------------|
| `requirements` | Solution Fit | Gathers workload, stack, scale, latency, persistence, and budget through workspace scan + structured interview. Decides whether ElastiCache is the right service and hands off with a routing recommendation. | I need a cache, speed up my app, reduce database load, lower Bedrock cost, should I use ElastiCache, what's best for my workload, evaluating cache options, ElastiCache vs X, Valkey vs X, vague new workload | — | `setup`, `data-modeling`, `genai`, `monitoring`, `migration` |
| `setup` | Create and Connect | Provisioning, connectivity, security, authentication, IaC, deployment choice. Gets the user to a working cache with least friction. Covers engine selection, serverless vs node-based, VPC, TLS, RBAC/IAM, jump-host/SSM tunnels, CLI/SDK/CFN/CDK/Terraform starters. | create a cache, set up ElastiCache, provision, Valkey cluster, connect Lambda/ECS/EKS/EC2, VPC, security groups, TLS, RBAC, IAM auth, jump host, SSM tunnel, CloudFormation, CDK, Terraform, engine selection, serverless vs node-based, backup, snapshot, restore, export | `requirements` (optional) | `data-modeling`, `genai`, `monitoring` |
| `data-modeling` | Application Patterns | Picks data structures, key schema, TTL strategy, invalidation approach, and client code for non-AI patterns: cache-aside, session store, rate limiting, leaderboards, counters, pub/sub, streams, shopping carts, job queues, activity feeds. | session store, rate limiting, leaderboard, cache-aside, query caching, counters, streams, pub/sub, shopping cart, job queue, activity feed, key schema, TTL, invalidation, data structures | `setup` (cache must exist) | `monitoring` |
| `genai` | AI and Vector Workloads | Classifies request into Mode 1 (plain cache), Mode 2 (semantic response cache), or Mode 3 (full vector search). Selects Valkey and forces node-based Valkey 8.2 or above (recommend 9.0) when server-side vector similarity is needed. Covers semantic caching, agent memory, RAG retrieval, recommendation, personalization, conversation/session persistence for AI agents, and framework wiring (Strands, mem0, LangChain). | semantic cache, RAG, agent memory, conversational memory, vector search, embeddings, recommendation, personalization, Bedrock latency, Bedrock cost, LLM caching, Strands, mem0, LangChain, conversation history, AI session store, embedding provider, framework integration | `setup` (cache must exist) | `monitoring` |
| `monitoring` | Operate and Observe | Diagnoses performance, cost, and reliability using metrics first, then recommends the smallest change. Covers dashboards, alarms, log delivery, cost reporting, event routing, troubleshooting high CPU / memory / replication lag / connection spikes / low hit rate / hot keys / big keys / slot imbalance / latency spike root cause. | cache is slow, cost too high, hit rate low, high CPU, memor

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-29
   !CAUTION B 89 / 100

   first audit · source 541dfda5ef29

Questions about amazon-elasticache

• github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialize — the audited source at commit 541dfda5ef29 and every finding aboveObserved · 29 Oct 2026

Spotted something wrong? Report a correction · Methodology