DescribeReplicationGroups: status, engine, cluster mode, node type, Multi-AZ, failover, encryption, shards with primary/reader endpoints and member roles. Queries every region in ELASTICACHE_REGIONS unless region is given.

DescribeCacheClusters: per-node-cluster engine version, node type, parameter group and apply status, maintenance window, pending changes and node endpoints.

DescribeServerlessCaches for ElastiCache Serverless (Valkey/Redis OSS/Memcached).

DescribeEvents, findings first: failover/failure critical, replacement/reboot/maintenance warning, worst then newest; counts per source and the 100 newest events (truncated if more). Invalid source_type is refused.

DescribeCacheParameters for a parameter group; by default only values changed (Source=user). Findings flag risky settings (noeviction, tiny output buffers, timeout 0, low maxmemory-samples).

DescribeSnapshots: age, size, status, automatic vs manual, with findings for retention gaps, failed snapshots and groups without automatic backups.

DescribeServerlessCacheSnapshots plus DescribeServerlessCaches: findings for caches without a recent snapshot, failed snapshots, snapshots about to expire, missing KMS key and unset retention.

DescribeUsers (RBAC): authentication type and access strings, never passwords. Flags users with '~* +@all' access and users without a password.

DescribeUserGroups: members, attached replication groups/serverless caches, pending changes.

RBAC map from Describe* calls: users x groups x caches. Findings first: ~* +@all users, unattached groups, enabled default user, no-password users in live groups, Memcached groups, caches without a group.

DescribeGlobalReplicationGroups: global datastore members, regions, roles and status.

Global datastore failover readiness from DescribeGlobalReplicationGroups and GlobalDatastoreReplicationLag. Findings first, then per datastore: readiness (blocked, attention, ready), reasons, primary region, and each secondary's status, node type, engine version and max replication lag.

DescribeReservedCacheNodes plus running nodes, findings first: reservations expiring in 30/90 days, reservations matching no node, nodes no reservation covers (node-hours billed on demand). All ELASTICACHE_REGIONS unless region.

DescribeReservedCacheNodesOfferings: 1y/3y offerings for a node type and engine (capped), the number of running nodes no reservation covers and the cheapest offering per term. Never purchases anything.

DescribeCacheEngineVersions: available versions with parameter group family, plus upgrade targets (latest minor of each major; latest Valkey when asking about Redis OSS).

DescribeCacheParameterGroups joined with running clusters: unused custom groups, family mismatch, and risky Source=user settings (noeviction, timeout, keepalive, reserved-memory, lazyfree, slowlog).

DescribeServiceUpdates: pending updates by severity with apply-by and auto-update dates.

DescribeCacheSubnetGroups: VPC, subnets and AZ spread (flags groups in fewer than 2 AZs).

CloudWatch AWS/ElastiCache metrics (Redis/Valkey: EngineCPUUtilization, memory %, Evictions, CacheHitRate, ReplicationLag; Memcached: CPU, swap, evictions, connections). Findings first, then min/avg/max/latest; raw series only with include_series=true.

DescribeCacheParameters on two groups: only parameters whose values differ and that someone modified (default-only differences are counted, not listed), plus family mismatch warnings.

One-call incident summary for a replication group: status, Multi-AZ/failover, 6h events, CloudWatch peaks per member, pending updates, snapshot age. Findings worst-first (max 30); a failing section is reported unavailable.

One-call incident summary for a serverless cache: status, usage limits, snapshot health, 6h ThrottledCmds/ECPU/storage vs limits. Findings worst-first (max 30); a failing section is reported unavailable.

Per-shard skew from CloudWatch only (no data-plane connection). Findings first: hot shard (over 2x the median and above 50% CPU), memory skew, one primary pinned near 100% CPU (hot-key signature).

Fleet backup hygiene (DescribeSnapshots plus groups/clusters). Findings first: retention 0, no recent automatic snapshot, latest failed, old manual snapshots, snapshots of deleted groups.

HA and config posture per replication group in one call. Findings first, each with a next tool: Multi-AZ or failover off, zero replicas, replicas in one AZ, big node without cluster mode, no snapshots or log delivery, encryption mix, network type.

Can this group or serverless cache be restored? Pass exactly one id. Findings first: backups off, stale, expired or failed snapshot, none before an engine upgrade, KMS mismatch, snapshot too big for the target node.

Would a primary failure be survived? Findings first: failover or Multi-AZ off, shards without replicas, replicas in the primary's AZ, uneven or unavailable replicas, single-node group, recovery-risk level.

Are replicas usable for reads? Findings first: clients likely on the primary endpoint, no reader endpoint, single-replica shards, replicas in the primary's AZ, high ReplicationLag.

Headroom for resharding or a node-type change, from 7 days of CloudWatch. Findings first: is scale-in safe (projected memory per surviving shard), is scale-out advised, why a node-type change is risky (burstable credits, replica lag, pending modification, Multi-AZ off). Describe and GetMetricData only.

Engine upgrade pre-flight, verdict first: go or no-go plus blockers (version path, Redis to Valkey, parameter group family, status, failover, snapshot freshness), then caveats (ACL/TLS, quirks, service updates, window). An unreadable gate blocks. Describe calls only.

CloudWatch alarm coverage. Findings first: alarms in ALARM, INSUFFICIENT_DATA or with actions disabled, members with no alarm on core metrics (CPU, memory, evictions, lag, connections, swap). partial=true if denied. No group id covers ELASTICACHE_REGIONS.

Maintenance urgency. Findings first: required updates past apply-by, maintenance windows overlapping the snapshot window, end-of-life engines. partial=true if a call is denied. No group id covers ELASTICACHE_REGIONS.

One findings-first call per replication group: shards, replicas, AZ spread, failover, engine version plus per-node CloudWatch signals; flags outlier nodes, reader gaps, right-sizing. No group id: fleet mode.

Fleet hardening roll-up from existing Describe data (no new IAM), Redis and Memcached. Findings first: counts by severity, findings by category (transit, at rest, auth, ACL, network, snapshots, patching) naming the resource, then a pass/fail matrix capped to top. A denied call is a note, partial=true.

Fleet cost and right-sizing, findings first: node type and count, reserved coverage, peak memory/CPU per group and serverless cache. Flags idle groups, oversized nodes (names the smaller node type), idle replicas, on-demand and non-Graviton nodes, old snapshots, uncapped serverless. All ELASTICACHE_REGIONS unless region.

Days until memory is full across the fleet, findings first, from 14 days of DatabaseMemoryUsagePercentage (Serverless: BytesUsedForCache vs the storage maximum), soonest first. Under 7 days critical, under 30 warning. All ELASTICACHE_REGIONS unless region is set.

One-shot health summary of the configured Redis/Valkey endpoint: engine and version, role, clients, hit ratio, memory vs maxmemory, fragmentation, evictions and a list of findings.

Why can't I connect: staged diagnosis of the endpoint, stopping at the first failure. DNS, TCP, TLS (and plaintext fallback), PING, AUTH, each timed with a verdict and one hint per failure class. Socket probes and PING only; credentials never echoed.

On-call snapshot of the connected endpoint: health, memory, replication, clients, failed commandstats, top-5 slowlog, latency, DOCTOR. Findings worst-first (max 30); a failing section is reported unavailable. Start here.

MEMORY DOCTOR and LATENCY DOCTOR of the connected node: the engine's advice plus findings for non-healthy lines. Engines that reject the command get a note, not an error. node_triage includes this.

Raw INFO output, optionally for a single section. Password-like keys are masked.

Memory breakdown: used/RSS/peak/dataset/overhead, maxmemory and policy, fragmentation ratio with a verdict, evictions, MEMORY STATS and MEMORY DOCTOR when the engine allows them.

Allowlisted CONFIG GET view (maxmemory policy, timeout, appendonly, output buffer limits, keyspace notifications, slowlog/latency thresholds, io-threads) with findings. Points at aws_parameters when CONFIG is refused, as ElastiCache usually does.

SLOWLOG entries plus per-command totals. Arguments beyond the key are hidden unless include_args is true.

CLIENT LIST aggregated by source IP, client name, ACL user and last command, idle-time stats and the clients holding the most buffer memory.

Who holds the connections: CLIENT LIST grouped by source IP, name or library, user and flags, top IPs, idle over 1h, big buffers, maxclients use. Capped rows per group; never commands, arguments or keys.

Client PING RTT percentiles, LATENCY LATEST events (needs latency-monitor-threshold > 0) and per-command p50/p99/p99.9 from LATENCY HISTOGRAM (Redis 7+/Valkey) with findings for heavy tails.

Valkey 8 COMMANDLOG (slow, large-request, large-reply): oversized payloads SLOWLOG misses. Findings first, top commands by size and client addresses; no arguments or values. Other engines get a note.

LATENCY LATEST, then HISTORY for the 3 worst events, findings first: fork or aof-fsync over 100 ms, expire-cycle spikes, trimmed LATENCY/MEMORY DOCTOR. With latency-monitor-threshold 0 the finding names it.

Commands ranked by CPU time (INFO commandstats): calls, usec per call, rejected and failed, error prefixes, p50/p99/p99.9 when available. Findings for OOM/READONLY/NOPERM errors and p99 over 10 ms.

Big keys, hot (LFU) or cold keys, type mix, TTL coverage, per-prefix bytes from a bounded SCAN. Metadata only, never values. partial=true at max_seconds. Cluster mode: this node only (see node_cluster_keyspace_sample). include_access adds the idle-key share; include_sizes flags large collections.

Replication role, replicas with byte lag, link status, backlog, plus findings: links down, lagging replicas (also vs the primary offset on a replica), replica-read-only, min-replicas-to-write, cluster-allow-reads- when-down. Engine quirks are notes, not errors.

ACL WHOAMI and recent ACL LOG entries (auth failures, denied commands, key/channel denials) with reason, user, client address, count; key and channel names hidden. Findings flag repeated auth failures and denial spikes. ACL LIST/GETUSER never used.

Cluster-mode view: CLUSTER INFO, slots per primary and CLUSTER SHARDS when available. Reports cluster mode disabled otherwise.

CLUSTER NODES parsed into per-shard primary/replica endpoints, slot counts and failing nodes, plus how to target each shard with ELASTICACHE_HOST.

Cluster-mode fan-out: INFO on every node (bounded concurrency, per-node timeout) flagging memory/ops skew across shards, failed nodes, uncovered slots and replica lag.

node_keyspace_sample on every shard primary: keys merged with a shard label, per-shard status, skew findings. A dead shard is reported, never fatal. Budget and sample split across primaries.

node_slowlog on every shard primary: the slowest entries overall labelled by shard, per-command totals and per-shard status. Arguments beyond the key are hidden unless include_args is true.

node_memory headline for every shard primary: used/RSS/maxmemory, fragmentation, evictions, with findings for memory skew between shards, shards above 90% of maxmemory and unreachable shards.

Cluster-mode shard skew and hot slots: per-shard keys, memory, ops/sec plus CLUSTER COUNTKEYSINSLOT on a capped slot sample. Findings name hot shards and slots; reached N/M shards. Counts only.

Pub/Sub pressure: channel and pattern counts, top channels by subscribers, subscribers with large output buffers. Counts only, never messages. Cluster mode aggregates shard primaries.

node_triage plus pub/sub pressure on every shard primary under one deadline: one ranked, deduplicated findings list naming node and shard (max 40). A dead shard is a critical finding, never fatal. Use first on a cluster-mode group.

Memcached summary (hit ratio, memory, evictions, connections) or a raw stats <group> output. Uses MEMCACHED_HOST/MEMCACHED_PORT.

Memcached fleet view over MEMCACHED_NODES: every node queried with bounded concurrency, only stats, stats slabs, stats items. Findings first: evictions, hit-ratio outliers, item/memory imbalance, listen_disabled_num, connections near maxconns, evicting slab classes. A dead node makes it partial.

Memcached auto-discovery check: config get cluster (MEMCACHED_HOST or the configuration endpoint) compared with DescribeCacheClusters nodes. Flags AWS nodes missing from the config, stale entries, engine version mismatch. An unreachable endpoint is a finding.