Frequently asked questions

#What is Memora?

Cloud Certainty Memora is a console for Amazon ElastiCache (Valkey, Redis OSS and Memcached) that runs entirely in your own AWS account. Your teams see every cache across accounts and Regions with its metrics, estimated cost and findings, operate it (backups, scaling, failover, engine upgrades including Redis OSS to Valkey, parameter groups, service updates), and, for Valkey and Redis OSS, browse keys, run commands, analyse memory and run bulk jobs, without cache passwords or a shared desktop tool. Administrators grant users and groups access per cache pattern and, on Business, per key pattern; Memora, AWS and the cache itself enforce every grant, and an audit log and a command history show who did what. You install it with one CloudFormation stack, and no data leaves your account.

#Pricing

#How much does it cost?

Memora is sold on AWS Marketplace with contract pricing: pay monthly, or for 12 months up front.

Prices are in US dollars and billed through your AWS bill. Plans are not priced per user, per cache, per node or per command: everyone in your organisation can use Memora.

#Why do Business and Enterprise appear as add-ons?

On the Memora listing, Team is the base plan and Business and Enterprise are add-ons to it. For Business, choose Team and the Business add-on; for Enterprise, choose all three. A plan counts only when every plan below it is in the contract too, so an add-on bought on its own grants nothing. Starter is a separate listing, Memora Starter.

#What else do I pay for?

ElastiCache itself, and the AWS resources the stack uses in your account, are billed to you by AWS as usual. Memora is serverless, so it costs close to nothing while nobody is using it.

The findings usually pay for the licence: moving one cache.r6g.large replication group with a replica from Redis OSS to Valkey saves about $60 a month, and a Redis OSS 5 cache of that size on Extended Support costs about $240 a month more than it needs to.

#What happens when the contract ends?

Memora keeps working on the last plan for up to 72 hours, then every page says a licence is required and only the licence page works for administrators. All data (connections, grants, scripts, command records, analyses, the audit log) stays in your account, and subscribing again unlocks it. Your caches keep running in ElastiCache either way. The same 72 hours cover a brief outage of AWS License Manager.

#Plans

#What does each plan include?

• Every plan has the fleet view with metrics, cost and findings across accounts and Regions; the cache pages with topology, metrics, events, backups, scaling, failover, reboots, engine upgrades (including Redis OSS to Valkey), parameter groups, tags and service updates; creating and deleting caches; the key browser and editors; the command workbench with autocomplete; private scripts with versions; command history; memory analysis; INFO, the slow log, clients and Pub/Sub sampling; ElastiCache users and user groups; connectors and IAM data access set-up; grants on cache patterns; connections to other accounts; usage totals; the audit log; and IAM Identity Center and Cognito sign-in with MFA.
• Team adds shared scripts, bulk delete, expire and persist by key pattern, and SAML and OIDC identity providers.
• Business adds key patterns in grants (support can fix carts without seeing payment tokens), usage per user and the IP allowlist.
• Enterprise has the Business features with the highest limits.

#How are AWS accounts counted?

Each distinct AWS account among your connections counts once, the hub account included. A connection can cover many Regions of its account at no extra count, and connectors don't count. When all are in use, new accounts can't be connected; accounts already connected keep working.

#Deployment

#Which AWS Regions are supported?

Any Region with Amazon ElastiCache, AWS Lambda, Amazon API Gateway, Amazon DynamoDB, AWS Step Functions, Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate, for example us-east-1, eu-west-1, eu-west-2, eu-central-1 and ap-southeast-2. The same template URL works in every Region. The Region you deploy to doesn't limit which Regions you can work in: the stack's LocalRegions parameter and each connection list the Regions to show, and a connector can run in any Region.

#How do I install it?

Subscribe on AWS Marketplace and launch one CloudFormation stack in the account that subscribed. Creation takes about 10 minutes. See Getting started and the installation guide.

#Does anything run in my VPC?

Two things. A one-off installer task, for about a minute at install and at each upgrade, which needs outbound HTTPS. And the connector: two small Lambda functions in each VPC that holds caches, because ElastiCache caches have no public endpoints. The connector accepts no inbound connections, connects only to ElastiCache endpoints, and costs nothing while nobody uses it. The rest of the stack runs outside your VPC.

#Do I need a bastion, VPN or port forwarding?

No. People use Memora in the browser; Memora reaches the data through the connector inside the VPC, and the connector is invoked only through AWS Lambda by Memora's roles.

#Does it work with many AWS accounts and VPCs?

Yes. Deploy the spoke role template in each account, or across an AWS Organization with a StackSet. Memora assumes that role with an external ID, and the role's access level (Read, Operate or Full) is the upper limit of what it can do there. Then deploy the connector template in each VPC that holds caches, in any account and Region, and register it in Memora. See Spoke accounts and Connectors.

#Which identity providers work?

Amazon Cognito users (with required MFA) and AWS IAM Identity Center on every plan. Other SAML 2.0 providers, such as Microsoft Entra ID and Okta, and OIDC providers on Team and above. See Identity providers.

#Can I run it offline or in an air-gapped environment?

Partly. At runtime Memora needs no internet access in your VPC: the connector reaches only your caches (and Secrets Manager, if you use secrets, which an interface endpoint can serve), and the rest of the stack uses AWS's own service endpoints. With UpdateChecks = Disabled the stack makes no call to Cloud Certainty at all. Install and upgrade are different: the installer task pulls the product image from the AWS Marketplace registry in us-east-1, which needs internet egress (a NAT gateway or public subnets) for about a minute, and CloudFormation loads the templates from the vendor's public bucket. People's browsers need to reach the portal (Amplify Hosting), Amazon Cognito and the API.

#Engines and caches

#Valkey or Redis OSS?

Memora works with both the same way. Valkey is an open source engine, compatible with Redis OSS clients, and it costs less on ElastiCache (20% less for node-based caches and 33% less for serverless). Memora's findings show the saving for every Redis OSS cache, Create a cache offers Valkey first, and Upgrade to Valkey on a cache's page switches a Redis OSS cache to Valkey in place, with the saving shown. ElastiCache can't switch a Valkey cache back to Redis OSS: take a backup first, and restore it into a new cache if you need to go back.

#What about Extended Support for Redis OSS?

Redis OSS 4 and 5 caches on ElastiCache are on paid Extended Support since 1 February 2026: 80% on top of the on-demand price until 31 January 2028, then 160% in the third year, and ElastiCache upgrades them to Valkey automatically after 31 January 2029. Standard support for Redis OSS 6 ends on 31 January 2027. Memora flags every such cache in the fleet's findings with the monthly surcharge, so you can see what the whole fleet pays, and the cache's Configuration tab upgrades it, to a newer Redis OSS or to Valkey in place.

#What works on ElastiCache Serverless?

Almost everything: the fleet, metrics (including ECPUs and throttled commands), findings, cost, backups, limits, settings, tags, the key browser, the workbench, analyses and Pub/Sub. ElastiCache Serverless refuses some commands, so Memora refuses them first and says why: no MEMORY USAGE (key sizes in analyses are estimated from value lengths, and the report says so), no slow log, no client list, no KEYS, no pattern subscriptions, and multi-key commands, transactions and scripts must stay in one hash slot. Serverless caches have no nodes, replicas, shards, parameter groups or service updates to manage. Commands Memora runs on a serverless cache are billed in ECPUs like any other client's.

#What does Memora do with Memcached?

Memcached caches (node-based and serverless) appear in the fleet with their metrics, cost and findings, and have the Overview, Metrics, Configuration and Events tabs: settings, scaling where ElastiCache allows it, rebooting nodes and deleting the cache. Memora doesn't read or change Memcached data in this release, so the Browser, Workbench, Analysis and Monitor tabs are not available for it, and Memcached keeps data in memory only, so ElastiCache takes no backups of it. Memora creates Valkey and Redis OSS caches only.

#How does Memora sign in to my caches?

Per cache, with one of three modes. IAM authentication (Valkey 7.2 or Redis OSS 7.0 and later, with encryption in transit and a user group): Memora creates the ElastiCache users memora-read and memora-write and signs short-lived tokens inside the connector, so there are no passwords at all. Secrets Manager, for AUTH tokens and users with passwords: the connector reads the secrets itself. No authentication, for caches without any. See Data access.

#Is it safe to use on a production cache?

That is what it is built for. The key browser and analyses use SCAN, never KEYS, in batches. Blocking and connection-holding commands never run, KEYS needs the cache id typed, FLUSHDB and FLUSHALL are off unless an administrator allows them, values and responses are cut at a size limit, and bulk jobs run at a rate you choose. A person without write can't change data, and the cache's own ACL backs that up with IAM data access.

#Data and security

#Does any data leave my account?

No. Your caches and their data stay in ElastiCache, and everything Memora stores (connections, connectors, grants, data access settings, scripts, command records, analyses, bulk jobs, the cache of cache lists and metrics, and the audit log) is in DynamoDB in your account. Cloud Certainty runs no service in the data path, and Memora sends no telemetry. The licence check is a read from AWS License Manager in your own account. The only outbound request to us is the optional daily read of a public release manifest, which sends nothing about you; set UpdateChecks to Disabled to turn it off. See the security overview.

#Does Memora store my cache data?

No. Values are read by the connector, shown in the browser that asked and dropped; they are never written to DynamoDB or logs. Command records keep command names and up to three keys per command, and the full command text only if an administrator turns on recording values. Memory analyses keep key names, types, sizes and TTLs, never values. Passwords for ElastiCache users go to AWS and are never stored by Memora.

#Can users only see what they are granted?

Yes. Users see no caches until an administrator grants them access, by cache id pattern, per account and Region. Each request runs with short-lived AWS credentials that a session policy limits to the user's grants, so AWS itself refuses a call on a cache the user may not use. Reading data (read), changing data (write), operating a cache (operate) and managing it (manage) are separate permissions, and on Business key patterns limit reads and writes to part of a cache. See Identity and authorization.

#Who ran this command?

Memora records who ran which commands on which cache, from the workbench, scripts and the key browser, with how long they took and whether they failed, and every data change in the audit log. In CloudTrail, every ElastiCache call and connector invocation Memora makes carries the user's email as its sourceIdentity, and the role session is named mm-<email>.

#Can Memora change my caches?

Only if you let it. The access level of each account sets the limit: Read allows looking and reading data only; Operate (the default) adds changing data and operating caches; Full adds creating, deleting and reconfiguring them. On top of that, each person needs a grant with the right permission on that cache, and every change is recorded in the audit log.

#How does it compare?

#Why not Redis Insight?

Redis Insight is a good desktop tool for one developer, but it doesn't fit a team on ElastiCache:

• It has no user accounts or roles: everyone who reaches it has every connection.
• It takes static passwords only; it has no IAM authentication for ElastiCache, so tokens that last 15 minutes don't work with it.
• Each person needs their own network path into the VPC and the cache's password, or the team runs it as a server all the time.
• Nothing records which person ran which command.

Memora has its own browser, workbench and memory analysis, built into the same app as the control plane, with what a team needs: one sign-in with your identity provider for the fleet, the control plane and the data; access per person (read, write, operate, manage, and key patterns) enforced by Memora, by IAM and by the cache's ACL; no passwords handed out (IAM authentication signed inside the connector, or Secrets Manager read only by the connector); no servers (two Lambda functions per VPC that cost nothing while idle); every command attributed to a person; and ElastiCache Serverless supported, with its restrictions handled.

#Why not the ElastiCache console?

Memora doesn't replace the AWS console for every task, but it covers what teams miss there:

#Why not a monitoring tool?

Monitoring tools are good at alerting across services, and they send your metrics to their service. Memora is a console: it reads ElastiCache and CloudWatch directly, as the person, in your account, and it also operates caches and works with their data, which monitoring tools don't.

#Upgrades

#How do I install a new release?

Each release is a new template. Update the hub stack with the new template URL and keep your parameter values, then set each connector stack's Version to the new release. Administrators see a banner when a new release is out. See the upgrading guide and the release notes.

#How do I change plan?

Email [email protected]: we prepare an AWS Marketplace offer that credits the rest of your current contract. Between Team, Business and Enterprise no stack update is needed: the new limits and features apply when the new contract is active, and Memora keeps working on your current plan for up to 72 hours while the agreement changes. Your scripts, records and settings stay as they are. See Changing plan.

#Support

#How do I get help?

Basic support is included: email [email protected] with your stack's Region, the release you run (the ProductVersion stack output) and what you see. We respond within one business day. Paid support plans with response times are on the support page.

#Does Cloud Certainty have access to my account?

No. We have no access to your account and Memora doesn't give us any. When you ask for help, you share what you choose, such as an error message or a cache's configuration.