Caching, Graph and Partner Databases

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

See the section bibliography for the reference material consulted while preparing these pages.

Commands and behaviour below are current for AWS CLI v2 (2.37 line) and the ElastiCache engines Valkey 9.x and Redis OSS up to 7.1, checked 2026-10-01. ElastiCache, MemoryDB and the partner offerings change quickly (Valkey 9.0 added durability and public endpoints for ElastiCache Serverless), so confirm flags with aws elasticache help and aws memorydb help and the linked reference pages before relying on them in automation. Region us-east-1 and account 111122223333 are placeholders throughout.

This page covers the data services Bookshelf reaches that are not a relational, document or search engine: the in-memory cache that sits in front of bookshelf-catalog (ElastiCache for Valkey serverless, bookshelf-cache), its durable sibling Amazon MemoryDB, and a map of the graph, time-series, vector and partner-run databases that the other database references on this site describe. ElastiCache and MemoryDB are kept as a short summary with a quick start. The depth (cluster mode, eviction, persistence, Spring Data Redis, Valkey modules, a side-by-side with Redis Cloud) lives in Deploying Redis on AWS, and the engine itself is documented from Getting Started onwards. For how every engine on this site maps to an AWS option, see Managed Databases on AWS; the Azure counterpart of this page is Redis and Partner Databases on Azure.

flowchart TD A["What do I need to store?"] --> B["Short-lived or derived data, rebuilt on a miss"] A --> C["In-memory data that is the system of record"] A --> D["Highly connected data and path queries"] A --> E["Vectors, wide-column, time series or metrics"] B --> B1["ElastiCache for Valkey, serverless first"] C --> C1["MemoryDB, or ElastiCache for Valkey 9 with durability"] D --> D1["Neptune, or Neo4j Aura from Marketplace"] E --> E1["Qdrant Cloud, Keyspaces, Timestream for InfluxDB, Managed Prometheus"]

ElastiCache in brief

Amazon ElastiCache is a managed in-memory cache and data store compatible with the Valkey, Redis OSS and Memcached protocols. Bookshelf uses it as a cache-aside layer in front of the catalog database: catalog-api looks a book up in the cache first, falls back to Aurora on a miss, and writes the row back with a time to live. The points that matter when you choose a deployment:

  • Valkey is the engine to pick. Valkey is the BSD-licensed fork of Redis that AWS invests in. ElastiCache for Valkey started at 7.2 and now offers 8.x and 9.x releases, while the Redis OSS engine is frozen at 7.1 (no newer Redis OSS version is offered). All features of Redis OSS 7.2 are available in Valkey 7.2 and later, and an existing Redis OSS cluster can be upgraded to Valkey in place. AWS also prices the Valkey engine below the Redis OSS engine; check the pricing page for the current difference. Older guides still show "ElastiCache for Redis" with Redis OSS 5 or 6.

  • Redis OSS end-of-support dates. Redis OSS 4 and 5 left standard support on 2026-01-31 and are billed under paid Extended Support until 2029-01-31. Redis OSS 6 standard support ends on 2027-01-31, with Extended Support until 2030-01-31. Plan the move to Valkey before those dates rather than paying the extended-support premium.

  • Serverless or node-based. ElastiCache Serverless has no nodes to size: you give it a name, an engine and optional usage limits, and it scales memory and compute on demand, always Multi-AZ, with TLS required. A node-based cluster has an explicit node type, shard and replica layout, which gives predictable and reservable capacity at the price of manual sizing. Older guides describe only node-based clusters.

  • Durability on Valkey 9. Since June 2026, ElastiCache for Valkey 9.0 offers optional durability through a Multi-AZ transactional log, with synchronous or asynchronous writes, so ElastiCache can act as a system-of-record store as well as a cache. This narrows the gap with MemoryDB described below (see Durability in ElastiCache and the launch announcement).

  • Public endpoints. Also new in Valkey 9.0, an ElastiCache Serverless cache can expose a public endpoint without a VPC. It requires IAM authentication and TLS 1.3. Bookshelf keeps the private VPC endpoint.

  • Modules. Valkey 8.2 and later include vector search from the open-source valkey-search module, and 9.0 adds full-text search and hybrid queries. Compare it with other vector stores in Comparing Vector Databases.

Valkey, Redis OSS and Memcached at a glance

Engine State on ElastiCache Pick it when

Valkey

Recommended, 7.2 through 9.x, serverless and node-based.

Any new cache, session store, rate limiter or leaderboard.

Redis OSS

Frozen at 7.1. Versions 4 to 6 are on a standard-support clock (see above).

Only to keep an existing cluster until you can migrate to Valkey.

Memcached

1.6.x, node-based and serverless variants exist.

Plain multithreaded key-value caching with no data structures or replication.

Quick start: ElastiCache for Valkey serverless

The Bookshelf cache lives in the private subnets of the VPC described in VPC Networking. Create it in the console or with a single CLI call.

In the AWS Management Console

  1. Select the Region (for example us-east-1) in the Region selector.

  2. Open Amazon ElastiCache and choose Valkey caches > Create cache.

  3. Choose Serverless, then Create a new cache (the cluster settings step does not apply to serverless).

  4. Enter the name bookshelf-cache and keep the default engine version (Valkey, latest major).

  5. Under Default settings choose Customize: pick the Bookshelf VPC, at least two private subnets in different Availability Zones and a security group that allows port 6379 from the catalog-api task security group only.

  6. Optionally set Cache usage limits (maximum data storage and maximum ECPUs per second) to cap the monthly bill.

  7. Under Security leave encryption at rest on (an AWS owned key unless you need your own KMS key) and choose a user group if you want IAM or password authentication.

  8. Choose Create and wait until the status is Available, then copy the cache endpoint.

Reference: Create a Valkey serverless cache.

With the AWS CLI

export AWS_REGION=us-east-1
SUBNETS="subnet-0aaa1111bbbb2222c subnet-0ddd3333eeee4444f"   # private subnets in two AZs (placeholders)
SG_CACHE=sg-0123456789abcdef0                                  # allows 6379 from the catalog-api security group

aws elasticache create-serverless-cache \
    --serverless-cache-name bookshelf-cache \
    --engine valkey \
    --major-engine-version 9 \
    --subnet-ids $SUBNETS \
    --security-group-ids "$SG_CACHE" \
    --cache-usage-limits 'DataStorage={Maximum=5,Unit=GB},ECPUPerSecond={Maximum=5000}' \
    --description "Bookshelf catalog cache"

aws elasticache describe-serverless-caches --serverless-cache-name bookshelf-cache \
    --query 'ServerlessCaches[0].[Status,Endpoint.Address,ReaderEndpoint.Address]' --output text

Reference: aws elasticache create-serverless-cache. Repeat the describe-serverless-caches call until Status is available. Set --major-engine-version to the highest major version aws elasticache describe-cache-engine-versions --engine valkey returns in your Region.

Test the connection from a host inside the VPC (an EC2 instance through Session Manager, or a CloudShell VPC environment). Serverless endpoints require TLS, so the client needs it too:

CACHE_HOST=$(aws elasticache describe-serverless-caches --serverless-cache-name bookshelf-cache \
    --query 'ServerlessCaches[0].Endpoint.Address' --output text)

valkey-cli -h "$CACHE_HOST" -p 6379 --tls PING
valkey-cli -h "$CACHE_HOST" -p 6379 --tls SET book:9780134685991 '{"title":"Effective Java"}' EX 300

Reference: Connect to a serverless cache. redis-cli works the same way if you already have it installed.

Node-based clusters

Choose a node-based replication group when the load is steady, you want reserved-node pricing, or you need a feature that serverless does not expose (data tiering, Global Datastore, a specific node type). The CLI shape is:

aws elasticache create-replication-group \
    --replication-group-id bookshelf-cache-nodes \
    --replication-group-description "Bookshelf catalog cache (node based)" \
    --engine valkey \
    --cache-node-type cache.r7g.large \
    --num-node-groups 2 --replicas-per-node-group 1 \
    --automatic-failover-enabled --multi-az-enabled \
    --cache-subnet-group-name bookshelf-cache-subnets \
    --security-group-ids "$SG_CACHE" \
    --transit-encryption-enabled --at-rest-encryption-enabled

Reference: aws elasticache create-replication-group. Create the bookshelf-cache-subnets subnet group first with aws elasticache create-cache-subnet-group. Cluster mode enabled, shards, Global Datastore and eviction policy are covered in Deploying Redis on AWS and Replication, Sentinel & Cluster.

IAM authentication

An ElastiCache user can authenticate with a short-lived IAM token instead of a password, so the application never holds a long-lived secret and access follows the same task-role policies as the rest of Bookshelf (see Identity and Access). The user and its user group are created once; each connection then presents a SigV4-presigned token signed by the caller’s role. The token is valid for 15 minutes and an authenticated connection stays open for up to 12 hours, so clients must re-authenticate when they reconnect.

# IAM-enabled user: the user name must equal the user ID
aws elasticache create-user \
    --user-id catalog-api \
    --user-name catalog-api \
    --engine valkey \
    --access-string "on ~book:* +@read +@write -@dangerous" \
    --authentication-mode Type=iam

# Serverless caches need a user group that contains the "default" user
aws elasticache create-user-group \
    --user-group-id bookshelf-users \
    --engine valkey \
    --user-ids default catalog-api

aws elasticache modify-serverless-cache \
    --serverless-cache-name bookshelf-cache \
    --user-group-id bookshelf-users

Reference: Authenticating with IAM for ElastiCache, aws elasticache create-user. Create or reuse a default user that has no permissions (--access-string "off ~* -@all") so that unauthenticated access stays closed.

The catalog-api task role then needs the elasticache:Connect action on both the cache and the user:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ConnectToBookshelfCache",
      "Effect": "Allow",
      "Action": "elasticache:Connect",
      "Resource": [
        "arn:aws:elasticache:us-east-1:111122223333:serverlesscache:bookshelf-cache",
        "arn:aws:elasticache:us-east-1:111122223333:user:catalog-api"
      ]
    }
  ]
}

Reference: Authenticating with IAM for ElastiCache. For a node-based replication group use the replicationgroup: ARN in place of serverlesscache:.

A separate policy lets the platform team manage caches without being able to read data:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ManageBookshelfCaches",
      "Effect": "Allow",
      "Action": [
        "elasticache:CreateServerlessCache",
        "elasticache:ModifyServerlessCache",
        "elasticache:DescribeServerlessCaches",
        "elasticache:DeleteServerlessCache",
        "elasticache:CreateUser",
        "elasticache:CreateUserGroup",
        "elasticache:DescribeUsers",
        "elasticache:DescribeUserGroups",
        "elasticache:AddTagsToResource",
        "elasticache:ListTagsForResource"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ServiceLinkedRoleForElastiCache",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::111122223333:role/aws-service-role/elasticache.amazonaws.com/AWSServiceRoleForElastiCache",
      "Condition": { "StringLike": { "iam:AWSServiceName": "elasticache.amazonaws.com" } }
    }
  ]
}

Reference: Identity and access management in Amazon ElastiCache. Narrow Resource to specific ARNs and add condition keys once the set of caches is stable.

Using it from Spring Boot

Spring Data Redis with the Lettuce client works unchanged against ElastiCache; only TLS has to be switched on.

spring:
  data:
    redis:
      host: ${CACHE_HOST}
      port: 6379
      ssl:
        enabled: true
      timeout: 2s

Reference: Spring Boot Redis support. IAM token generation for the password field, the cache abstraction and the Spring Boot cache setup are walked through in Deploying Redis on AWS and Spring Boot: Redis as a Cache.

Networking and security

  • ElastiCache and MemoryDB endpoints are private IP addresses in your subnets. Reach them from compute in the same VPC (or a peered or Transit Gateway-attached one) and place the cache in private subnets. A laptop cannot connect directly, so use a bastion through Session Manager, Client VPN (see VPN and Hybrid Connectivity) or CloudShell in the VPC.

  • Open port 6379 (and 6380 for the serverless reader endpoint) only from the application security groups, never from 0.0.0.0/0.

  • Keep encryption in transit on. Serverless requires TLS; node-based groups enable it with --transit-encryption-enabled.

  • Lambda functions that cache in ElastiCache must be attached to the same VPC; see AWS Lambda.

  • Prefer IAM authentication, or store a user’s password in Secrets Manager (see Secrets Manager, Parameter Store and KMS). Choose a customer managed KMS key only when policy requires it.

Pricing model

No prices are quoted here; use the ElastiCache pricing page and the AWS Pricing Calculator, which are updated regularly. ElastiCache Serverless is billed on the data stored (per GB-hour, with a minimum that depends on the engine) and on the compute consumed (ElastiCache Processing Units, ECPUs). Node-based clusters are billed per node-hour for the chosen node type and can use reserved nodes. Both add backup storage beyond the free allowance and inter-AZ and internet data transfer. Redis OSS Extended Support is an extra hourly charge per node. Set usage limits on the serverless cache so a runaway client cannot raise the bill, and compare the Valkey and Redis OSS rates before migrating.

Limits and quotas

Per-cache limits (maximum data size, ECPU range, maximum item size, connections) differ between serverless and node-based caches and between engines, and some are adjustable through Service Quotas. See ElastiCache quotas and ElastiCache endpoints and quotas.

Amazon MemoryDB in brief

Amazon MemoryDB is a durable, Multi-AZ, Valkey- and Redis OSS-compatible in-memory database. Every write is stored in a Multi-AZ transactional log before it is acknowledged, so a node failure recovers without data loss and MemoryDB can be the system of record, not just a cache in front of one. It is node-based (no serverless mode at the time of writing; re-verify), it runs Valkey, and its clusters are built from shards, each with a primary and up to five replicas, secured by an ACL.

ElastiCache MemoryDB

Durability

Cache by default. Valkey 9.0 adds an optional Multi-AZ transactional log.

Durable by design, with a Multi-AZ transactional log on every write.

Capacity model

Serverless or node-based.

Node-based shards and replicas.

Authentication

Users and user groups, IAM or password.

Users and ACLs, IAM or password.

Pick it for

Caches, sessions, rate limits, leaderboards.

A primary store with Redis data structures and microsecond reads, such as a shopping basket or a queue-like workload.

For Bookshelf, MemoryDB would hold the shopping baskets before an order is placed, because losing a basket on a failover is visible to users; the catalog cache stays on ElastiCache because it is rebuilt on a miss.

In the AWS Management Console

  1. Select the Region and open Amazon MemoryDB.

  2. Choose Subnet groups > Create subnet group, name it bookshelf-memorydb-subnets and select the private subnets of the Bookshelf VPC.

  3. Choose Create cluster. Enter the name bookshelf-baskets, choose an engine (Valkey), a node type, the number of shards and replicas per shard, and keep Multi-AZ on.

  4. Under Connectivity choose the subnet group and a security group allowing port 6379 from the application, and keep Encryption in transit enabled.

  5. Under Security pick an Access Control List (ACL); create one first under Access control > Users and ACLs.

  6. Choose Create and copy the cluster endpoint when the status is Available.

Reference: Getting started with MemoryDB.

With the AWS CLI

aws memorydb create-subnet-group \
    --subnet-group-name bookshelf-memorydb-subnets \
    --subnet-ids $SUBNETS

# IAM-authenticated user and the ACL that contains it
aws memorydb create-user \
    --user-name catalog-api \
    --access-string "on ~basket:* &* +@all -@dangerous" \
    --authentication-mode Type=iam

aws memorydb create-acl --acl-name bookshelf-acl --user-names catalog-api

aws memorydb create-cluster \
    --cluster-name bookshelf-baskets \
    --node-type db.r7g.large \
    --engine valkey \
    --acl-name bookshelf-acl \
    --subnet-group-name bookshelf-memorydb-subnets \
    --security-group-ids "$SG_CACHE" \
    --num-shards 1 --num-replicas-per-shard 1 \
    --tls-enabled

aws memorydb describe-clusters --cluster-name bookshelf-baskets \
    --query 'Clusters[0].[Status,ClusterEndpoint.Address]' --output text

Reference: aws memorydb create-cluster, Authenticating with IAM for MemoryDB. The IAM permission is memorydb:connect on the cluster and the user ARNs:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "memorydb:connect",
      "Resource": [
        "arn:aws:memorydb:us-east-1:111122223333:cluster/bookshelf-baskets",
        "arn:aws:memorydb:us-east-1:111122223333:user/catalog-api"
      ]
    }
  ]
}

Reference: Authenticating with IAM for MemoryDB. MemoryDB pricing combines node-hours with the volume of data written to the transactional log, plus backup storage and data transfer; see MemoryDB pricing. The vector search capability of MemoryDB is compared with other stores in Comparing Vector Databases.

Graph databases: Neptune, Neo4j Aura

Amazon Neptune is the AWS-native graph database. A Neptune cluster has one writer and up to 15 read replicas sharing a Multi-AZ storage volume, in the same architecture style as Aurora (see Amazon Aurora), with point-in-time recovery and continuous backup to S3. Neptune speaks three query languages: Apache TinkerPop Gremlin and Neo4j’s openCypher for property graphs, and W3C SPARQL for RDF. Neptune Analytics is a separate in-memory engine for running graph algorithms and vector similarity over existing graphs or data-lake files. Neptune can run provisioned or Serverless (scaling in Neptune capacity units).

Neptune Neo4j Aura on AWS

Run by

AWS (native service, IAM, VPC, KMS).

Neo4j, sold through AWS Marketplace; the cluster lives in Neo4j’s control plane.

Query languages

Gremlin, openCypher, SPARQL.

Cypher (the full Neo4j dialect) and the Graph Data Science library.

Pick it for

Staying inside AWS tooling, RDF/SPARQL, IAM-based access.

Full Neo4j feature set, GDS algorithms and tooling, existing Cypher code.

openCypher in Neptune covers most day-to-day Cypher but not the whole Neo4j dialect, procedures such as APOC, or the Graph Data Science library, so queries written against Neo4j need testing before a migration. Learn the language and data modelling from Cypher fundamentals, The property graph model and the engine comparison in Neo4j vs. relational and other graph databases; the Neo4j reference index is Neo4j Reference.

A minimal Neptune Serverless cluster for Bookshelf recommendations ("readers who bought this also bought"):

aws neptune create-db-subnet-group \
    --db-subnet-group-name bookshelf-graph-subnets \
    --db-subnet-group-description "Bookshelf graph subnets" \
    --subnet-ids $SUBNETS

aws neptune create-db-cluster \
    --db-cluster-identifier bookshelf-graph \
    --engine neptune \
    --db-subnet-group-name bookshelf-graph-subnets \
    --vpc-security-group-ids "$SG_CACHE" \
    --storage-encrypted \
    --iam-database-authentication-enabled \
    --serverless-v2-scaling-configuration MinCapacity=1,MaxCapacity=8

aws neptune create-db-instance \
    --db-instance-identifier bookshelf-graph-writer \
    --db-cluster-identifier bookshelf-graph \
    --engine neptune \
    --db-instance-class db.serverless

Reference: aws neptune create-db-cluster, Neptune Serverless. In the console the equivalent is Amazon Neptune > Databases > Create database, choosing Serverless, the VPC, the subnet group and IAM database authentication. Re-check the --serverless-v2-scaling-configuration bounds against the page above for your engine version; Neptune is billed per capacity-unit-hour (serverless) or instance-hour (provisioned) plus storage, I/O and backups, see Neptune pricing. Neptune endpoints are private to the VPC, so run queries from compute inside it or from a Neptune notebook, and sign requests with SigV4 when IAM authentication is on.

Neo4j AuraDB on AWS is subscribed to from AWS Marketplace and created in Neo4j’s own console; it connects over a public TLS endpoint or a Private Link connection. Billing goes through the Marketplace subscription, and the cluster is deleted from the Aura console, not from AWS.

Couchbase Capella and Qdrant Cloud

Two engines this site documents have no AWS-native equivalent and are bought as partner services in AWS Marketplace, or run yourself on EKS (see EKS Clusters) with their Kubernetes operators.

The workflow is the same for every Marketplace partner: subscribe from the listing in the console, then create the cluster or project in the vendor’s own control plane, choosing AWS and a Region close to your compute. Prefer a private connection (AWS PrivateLink or peering, where the vendor offers it) over an allow-listed public endpoint, and keep the vendor API key in Secrets Manager. The subscription is billed through your AWS invoice; the data and the cluster live in the vendor’s account, not yours, so IAM policies, KMS keys and aws commands in your account do not manage them. Check each vendor’s documentation for pricing, regions and private-link support before you commit.

Time series and metrics: Timestream and Managed Prometheus

  • Amazon Timestream for LiveAnalytics has been closed to new customers since 2025-06-20; existing payer accounts can keep using it (see Amazon Timestream for LiveAnalytics availability change). Amazon Timestream for InfluxDB is the managed InfluxDB service AWS recommends for new time-series workloads.

  • Amazon Managed Service for Prometheus is a serverless, Prometheus-compatible metrics store. Prometheus servers or the OpenTelemetry collector send samples to a workspace with remote write, and Amazon Managed Grafana (or any Grafana) queries it with PromQL. Learn the engine from Prometheus & Monitoring and the remote-write model from Storage, federation & remote write; the wider CloudWatch and tracing story is in Monitoring and Observability.

aws amp create-workspace --alias bookshelf
WORKSPACE_ID=$(aws amp list-workspaces --alias bookshelf --query 'workspaces[0].workspaceId' --output text)
aws amp describe-workspace --workspace-id "$WORKSPACE_ID" --query 'workspace.prometheusEndpoint' --output text

Reference: aws amp create-workspace. Console path: Amazon Managed Service for Prometheus > All workspaces > Create. The remote-write endpoint is the workspace endpoint plus api/v1/remote_write, and the caller needs aps:RemoteWrite; see Ingest metrics to the workspace. Billing is by samples ingested, stored and queried, see the Managed Prometheus pricing page.

Retired and shrinking AWS database services

Older guides still list these; do not start new work on them.

  • Amazon QLDB (the ledger database) reached end of support on 2025-07-31. AWS recommends moving ledger workloads to Aurora PostgreSQL (see Amazon Aurora) with an audit table or the PostgreSQL ledger patterns (see Services in full shutdown).

  • Amazon Keyspaces (for Apache Cassandra) is the managed, serverless Cassandra-compatible service and remains available; the documentation shows no end-of-support notice at the time of writing (re-verify on the service lifecycle page). It has no engine reference on this site: use it when you must keep Cassandra drivers and CQL, otherwise prefer Amazon DynamoDB.

  • Timestream for LiveAnalytics is closed to new customers (see above).

The authoritative lists are the AWS service lifecycle pages.

Troubleshooting

Symptom Likely cause and fix

Client times out connecting to the cache or cluster

Not in the VPC, or the security group does not allow 6379 from the client. Check the route, the subnet group and the security group, and reach it from a host in the same VPC.

SSL/handshake errors, or the connection resets after connect

The server requires TLS and the client does not use it. Enable TLS (--tls, spring.data.redis.ssl.enabled=true).

NOAUTH or WRONGPASS errors

The user group or ACL requires authentication and the client sent none, or the user is not in the cache’s user group.

IAM authentication fails or drops after a few minutes

The IAM user’s name differs from its ID, the role lacks elasticache:Connect or memorydb:connect on both ARNs, the token is older than 15 minutes, or the connection ran longer than 12 hours and must be re-authenticated.

MOVED or CROSSSLOT errors

A non-cluster-aware client talks to a cluster-mode endpoint, or a multi-key command spans hash slots. Use a cluster-aware client and hash tags.

Evictions or OOM command not allowed

The cache is full. Raise the usage limit, resize the nodes, shorten TTLs, or fix the eviction policy (see Architecture, Keyspace & Eviction).

Latency spikes

Large keys, slow commands or a hot shard. Check the CurrConnections, engine CPU and slow-log metrics in CloudWatch.

Serverless cache scaling is slow for a sudden spike

Scale-out is fast but not instant. Warm the cache or raise the minimum usage limit before a known launch.

Neptune query is rejected or very slow

A Gremlin or Cypher feature is unsupported, or IAM authentication is on and the request is unsigned. Check the supported language version and sign requests with SigV4.

For Redis-level administration and monitoring see Administration, Monitoring & Troubleshooting.

Clean up

Delete in dependency order and confirm each resource disappears. Caches and clusters accrue charges until they are deleted.

# ElastiCache serverless cache, user group and users
aws elasticache delete-serverless-cache --serverless-cache-name bookshelf-cache
aws elasticache delete-user-group --user-group-id bookshelf-users
aws elasticache delete-user --user-id catalog-api

# ElastiCache node-based replication group and its subnet group (if you created them)
aws elasticache delete-replication-group --replication-group-id bookshelf-cache-nodes --no-retain-primary-cluster
aws elasticache delete-cache-subnet-group --cache-subnet-group-name bookshelf-cache-subnets

# MemoryDB cluster, then ACL, user and subnet group
aws memorydb delete-cluster --cluster-name bookshelf-baskets
aws memorydb delete-acl --acl-name bookshelf-acl
aws memorydb delete-user --user-name catalog-api
aws memorydb delete-subnet-group --subnet-group-name bookshelf-memorydb-subnets

# Neptune: instance first, then cluster, then subnet group
aws neptune delete-db-instance --db-instance-identifier bookshelf-graph-writer --skip-final-snapshot
aws neptune delete-db-cluster --db-cluster-identifier bookshelf-graph --skip-final-snapshot
aws neptune delete-db-subnet-group --db-subnet-group-name bookshelf-graph-subnets

# Managed Prometheus workspace
aws amp delete-workspace --workspace-id "$WORKSPACE_ID"

Reference: aws elasticache delete-serverless-cache. A user group cannot be deleted while a cache uses it and a user cannot be deleted while it belongs to a group, so run the commands in the order shown and wait for each deletion to finish. Use --final-snapshot-name on a cache or cluster whose data you may want back. Cancel Marketplace subscriptions (Neo4j Aura, Couchbase Capella, Qdrant Cloud) in the vendor’s own console and then in AWS Marketplace under Manage subscriptions; deleting AWS resources does not stop them.

Related pages

References