Amazon ElastiCache Serverless for Valkey now offers public endpoints in AWS GovCloud (US) Regions, letting you connect to a fully managed cache from serverless functions or external applications without a VPC, VPN, bastion host, or SSH tunnel. Every connection uses IAM authentication over TLS 1.3 with no passwords to manage, and the feature is available at no extra charge beyond standard ElastiCache Serverless pricing.
What Public Endpoints Enable for GovCloud Workloads
Public endpoints let you reach an ElastiCache Serverless cache directly from AWS Lambda, AWS Fargate, or any application running outside a VPC in AWS GovCloud (US) Regions. This removes the need to provision VPC subnets, security groups, or NAT gateways just for cache connectivity, which simplifies architectures for workloads that must stay in GovCloud partitions. You can now build serverless-first applications that use a low-latency cache layer without the networking overhead that traditionally accompanies government cloud environments.
You create a Valkey 9.0 or later serverless cache with a public endpoint through the AWS Management Console, AWS CLI, or AWS SDK in under a minute. The cache scales automatically based on traffic patterns and you pay only for the data stored and requests served, with no additional fee for the public endpoint itself. This consumption model aligns with serverless economics where idle capacity costs nothing and scaling happens without operator intervention.
This expansion means public endpoints are now available in all commercial AWS Regions, AWS GovCloud (US) Regions, and China Regions, giving you a consistent connectivity model across partitions for Valkey-based caching. Teams operating across multiple AWS partitions can standardize on the same client libraries, authentication patterns, and operational playbooks regardless of which Region hosts their workloads.
Authentication and Client Requirements
Every connection to a public endpoint uses IAM authentication over TLS 1.3, so there are no static passwords to store, rotate, or leak. The cache endpoint validates the caller's IAM identity before allowing any data operations, which aligns with zero-trust networking principles required in many government environments. This approach eliminates credential management overhead while providing cryptographic assurance that only authorized principals can access the cache.
Supported clients include Valkey GLIDE 2.2 or later, which has built-in IAM token generation, or any Valkey client paired with the Developer Toolkit for ElastiCache, an open-source library that handles token creation and refresh automatically. Both options eliminate custom credential management code and reduce the surface area for authentication-related bugs. The Developer Toolkit integrates with standard AWS credential chains so it works seamlessly with IAM roles for service accounts, EC2 instance profiles, and federated identities.
Because authentication is tied to IAM, you can use standard IAM policies and conditions to restrict which principals can connect, enabling fine-grained access control without additional infrastructure. You can scope permissions to specific cache clusters, limit access to particular IP ranges, or require multi-factor authentication for sensitive operations. These controls integrate with existing governance tooling like AWS Config rules and CloudTrail logging for audit compliance.
Operational Impact and Getting Started
Teams can now build serverless-first architectures in GovCloud that use ElastiCache as a low-latency data layer without VPC networking overhead. This is especially useful for event-driven workloads, API backends, and real-time features where provisioning a VPC would add cost and complexity. The elimination of VPC requirements also reduces the blast radius of network misconfigurations and simplifies security reviews for compliance-focused deployments.
To get started, create a Valkey 9.0+ serverless cache with a public endpoint using the console, CLI, or SDK. The documentation at Create a Valkey serverless cache with a public endpoint walks through the steps and shows example connection code for supported clients. The guide covers both Valkey GLIDE integration and the Developer Toolkit approach so you can choose the client library that best fits your application stack.
There is no additional charge for public endpoints beyond standard ElastiCache Serverless pricing, so you can adopt the feature without a pricing model change. Monitor usage through CloudWatch metrics for cache hits, misses, and latency to right-size your workload and set alarms for performance degradation. The serverless model means you only pay for actual usage, making it straightforward to experiment with caching patterns before committing to production-scale deployments.
What to do next
Create a Valkey 9.0 serverless cache with a public endpoint in your GovCloud Region today using the console or CLI, then connect from a Lambda function using Valkey GLIDE 2.2 to validate the IAM-over-TLS flow.
Source: Public endpoints for Amazon ElastiCache Serverless now in AWS GovCloud (US) (AWS).
