Global Session Store: Sub-Millisecond Auth with ElastiCache Redis
Architecting a multi-AZ session store supporting 500,000 active users with automatic TTL eviction and sub-millisecond token lookups.
1. Business Problem & Context
A financial services web portal authenticates millions of active users. Every single API request requires validating the user’s session token and permissions. Querying relational databases on every HTTP request introduced 40ms of latency per call and saturated database CPU.
2. Requirements & Constraints
- Sub-Millisecond Token Validation: < 1ms latency for session token checks.
- Automatic Session Expiry: Expire idle sessions after 30 minutes using native TTL.
- High Availability: Automatic Multi-AZ failover with zero manual intervention.
3. Architecture Overview & Data Flow
Interactive Architecture Diagram (Use controls to zoom & pan)
4. AWS Services Used & Rationales
AWS Services Architecture Rationale
Concrete reasons why these specific services were chosen over alternatives
| Service | Category | Architectural Rationale ("Why this service?") |
|---|---|---|
| Amazon ElastiCache Redis | Database | Delivers sub-millisecond latency for token verification and supports built-in TTL expiration keys. |
| AWS KMS | Security | Provides encryption at rest for in-memory snapshots and transit TLS encryption. |
5. Key Design Trade-offs
Architecture Decision & Trade-Off Matrix
Evaluating alternative approaches under real-world constraints
Relational Database Session Table
- + Zero additional services
- − High disk I/O
- − 40ms query overhead
- − Database locks during high concurrency
ElastiCache Redis Multi-AZ (Chosen)
✓ Chosen Design- + Sub-millisecond reads
- + Native key expiration (TTL)
- + Automatic Multi-AZ failover
- − In-memory data cost
6. Implementation Highlights
Data Design Redis Key Schema with Atomic TTL
# Store session with 1800 second (30 minute) TTL
SET session:token_9847fae391 '{"user_id": "u_882", "roles": ["admin"], "mfa": true}' EX 1800
# Extend session TTL on active user interaction
EXPIRE session:token_9847fae391 18007. Results & Key Metrics
- API Latency: 38ms overall reduction across all authenticated endpoints.
- Database Load: Reduced primary database CPU from 82% to 14%.
8. Key Architectural Takeaways
Session Rule: Never hit persistent disk databases for request-level authentication checks. Always use in-memory caches like Redis with strict TTL expiration.
