let elastiCache_replicationGroup = Resources.*[
	Type == "AWS::ElastiCache::ReplicationGroup"
]

rule elasticache_redis_encryption_in_transit when %elastiCache_replicationGroup !empty {
	%elastiCache_replicationGroup {
		Properties {
			when Engine == "redis" {
				TransitEncryptionEnabled exists <<Encryption in transit is not configured (i.e. disabled).>>
				when TransitEncryptionEnabled exists {
					TransitEncryptionEnabled == true <<Encryption in transit is disabled.>>
				}
			}
		}
	}
}

rule elasticache_redis_encryption_at_rest when %elastiCache_replicationGroup !empty {
	%elastiCache_replicationGroup {
		Properties {
			when Engine == "redis" {
				AtRestEncryptionEnabled exists <<Encryption at rest is not configured (i.e. disabled).>>
				when AtRestEncryptionEnabled exists {
					AtRestEncryptionEnabled == true <<Encryption at rest is disabled.>>
				}
			}
		}
	}
}


rule elasticache_redis_multi_az when %elastiCache_replicationGroup !empty {
	%elastiCache_replicationGroup {
		Properties {
			when Engine == "redis" {
				MultiAZEnabled exists <<MultiAZ is not configured (i.e. disabled).>>
				when MultiAZEnabled exists {
					MultiAZEnabled == true <<MultiAZ is disabled.>>
				}
			}
		}
	}
}

rule elasticache_redis_auto_backups when %elastiCache_replicationGroup !empty {
	%elastiCache_replicationGroup {
		Properties {
			when Engine == "redis" {
				SnapshotRetentionLimit exists <<Automatic backup is not configured (i.e. disabled).>>
				when SnapshotRetentionLimit exists {
					SnapshotRetentionLimit > 0 <<Automatic backup is disabled.>>
				}
			}
		}
	}
}

rule elasticache_redis_retention_period when %elastiCache_replicationGroup !empty {
	%elastiCache_replicationGroup {
		Properties {
			when Engine == "redis" {
				SnapshotRetentionLimit exists <<Snapshot retention period is not configured (i.e. disabled).>>
				when SnapshotRetentionLimit exists {
					SnapshotRetentionLimit >= 7 <<Snapshot retention period is less that 7 days.>>
				}
			}
		}
	}
}