feat(infra): Add IAM support for Redis

[justin-tahara]

Description

[Provide a brief description of the changes in this PR]
Adding support for Redis IAM

How Has This Been Tested?

[Describe the tests you ran to verify your changes]

Backporting (check the box to trigger backport action)

Note: You have to check that the action passes, otherwise resolve the conflicts manually and tag the patches.

• This PR should be backported (make sure to check that the backport attempt succeeds)
• [Optional] Override Linear Check

---

Summary by cubic

Adds Redis IAM authentication for AWS ElastiCache behind a USE_REDIS_IAM_AUTH flag. Enables passwordless, TLS-secured connections for both sync and async Redis usage, and updates Celery config to work with IAM.

• New Features
  • Added USE_REDIS_IAM_AUTH env flag to enable Redis IAM auth.
  • New onyx/redis/iam_auth.py to configure IAM SSL context and strip passwords.
  • redis_pool: IAM takes precedence over REDIS_SSL, uses system CAs, no password, SSL enforced.
  • Async Redis connection path updated to apply IAM settings when enabled.
  • Celery Redis URL no longer forces rediss query params when IAM is on.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
internal-search	Ready	Preview	Comment	Aug 27, 2025 1:24am

[justin-tahara]

@greptileai

[greptile-apps]

Greptile Summary

This review covers only the changes made since the last review (commit 96aacb9), not the entire PR.

The most recent changes address the code duplication issue identified in the previous review by refactoring the SSL context creation logic. The developer has extracted the SSL context setup code into a dedicated create_redis_ssl_context_if_iam() function and modified configure_redis_iam_auth() to call this function instead of duplicating the SSL context creation logic.

The refactored code now follows the DRY (Don't Repeat Yourself) principle more effectively. The create_redis_ssl_context_if_iam() function centralizes the SSL context creation with system CA certificates, hostname verification, and certificate requirements. The configure_redis_iam_auth() function now simply calls this helper function to obtain the SSL context, eliminating the code duplication that existed in the previous version.

This change maintains the same functionality for Redis IAM authentication while improving code organization and maintainability. The SSL context configuration remains consistent across both functions, ensuring that IAM authentication continues to work properly with AWS ElastiCache using system CA certificates and proper SSL verification.

Confidence score: 5/5

• This PR is safe to merge with minimal risk
• Score reflects successful resolution of the previous code duplication concern and simple refactoring with no functional changes
• No files require special attention

_{1 file reviewed, no comments}

_{Edit Code Review Bot Settings | Greptile}

[cubic-dev-ai]

5 issues found across 4 files

_{React with 👍 or 👎 to teach cubic. You can also tag @cubic-dev-ai to give feedback, ask questions, or re-run the review.}