Matthew Bessette
34 lines
1.8 KiB
Markdown
34 lines
1.8 KiB
Markdown
---
|
|
name: redis
|
|
description: >-
|
|
Inspect Cleo ElastiCache (Valkey/Redis) caches through a local read-only proxy.
|
|
Use when the user asks to look at, list, or check Redis/Valkey/cache keys,
|
|
TTLs, sizes, or key counts for a service in dev or prod.
|
|
user-invocable: true
|
|
argument-hint: '[service and question about cache contents]'
|
|
---
|
|
# redis
|
|
|
|
`~/Projects/redis-proxy/redis-proxy` finds the cluster, reads its AUTH token from SSM, and listens on `127.0.0.1` with no auth. TLS and AUTH happen upstream, so never handle a token or use `rediss://`. Only read commands are forwarded; anything else returns `-ERR redis-proxy: <CMD> blocked (read-only)`.
|
|
|
|
```sh
|
|
~/Projects/redis-proxy/redis-proxy list --env dev|prod
|
|
~/Projects/redis-proxy/redis-proxy up <name> --env dev|prod [--port 16379] [--primary] # run with run_in_background
|
|
valkey-cli -p 16379 <command>
|
|
```
|
|
|
|
Wait for `listening on 127.0.0.1:<port>` in the background output before connecting. Stop the proxy when done. If it reports no SSO session, ask the user to run the `! aws sso login --profile <profile>` command it prints.
|
|
|
|
## PII/PHI rules (org policy: never put PII/PHI into Claude)
|
|
|
|
- Prefer `SCAN ... COUNT`, `TYPE`, `TTL`, `STRLEN`, `MEMORY USAGE`, `DBSIZE`, `INFO keyspace` over reading values. Avoid `KEYS`.
|
|
- Key names can contain emails or IDs. Don't repeat a key that looks like an email in output; refer to "the key".
|
|
- In prod, don't `GET`/`HGETALL`/`LRANGE` etc. on keys that look like sessions, users, messages, or profiles unless the user explicitly asks, and then summarize shape (field names, sizes) rather than pasting values.
|
|
- Never read or print the SSM token.
|
|
|
|
## Notes
|
|
|
|
- The proxy uses the reader endpoint by default; `--primary` switches. Dev can pass `--allow-writes`; prod refuses it.
|
|
- Default port is 16379. Pass `--port` to run several proxies side by side.
|
|
- Logs show blocked command names only.
|