Redis ACL
Access Control Lists, or ACLs, let you create separate Redis users with their own passwords and limited permissions. Each user can run only the commands, touch only the keys, and use only the channels you allow. ACLs arrived in Redis 6 and replace the old single shared password approach.
The Office Badge Analogy
An office gives every employee a badge. A receptionist badge opens the front door only. An engineer badge opens the lab. A manager badge opens everything. Redis ACL users work like badges, and each rule opens or locks one door.
User "reporter" User "cacheapp" User "admin" ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ Read only │ │ Read + write │ │ All commands │ │ Keys report:*│ │ Keys cache:* │ │ All keys │ └──────────────┘ └──────────────┘ └──────────────┘
Creating a User with ACL SETUSER
127.0.0.1:6379> ACL SETUSER reporter on >S3cretPass ~report:* +@read OK
Each token in the command has a meaning.
Token Meaning ──────────── ─────────────────────────────────────────── on User is active (off blocks login) >S3cretPass Adds a password (a leading > marks a password) ~report:* User may touch keys that match report:* +@read User may run commands in the read category -@dangerous Blocks commands in the dangerous category +get Allows one named command &alerts:* User may use channels that match alerts:* nopass User needs no password (avoid on real servers)
Command Categories
Redis groups commands into categories such as @read, @write, @set, @list, @pubsub, @admin, and @dangerous. Allowing a category saves you from listing every command. View all categories with ACL CAT.
127.0.0.1:6379> ACL CAT dangerous 1) "flushall" 2) "flushdb" 3) "keys" ...
Logging In as a User
127.0.0.1:6379> AUTH reporter S3cretPass OK 127.0.0.1:6379> GET report:sales "48210" 127.0.0.1:6379> SET report:sales 0 (error) NOPERM this user has no permissions to run the 'set' command 127.0.0.1:6379> GET secret:key (error) NOPERM this user has no permissions to access one of the keys used as arguments
Redis blocks the write and the access outside the allowed key pattern.
Inspecting and Removing Users
ACL LIST → shows every user and its rules ACL WHOAMI → shows the current user name ACL GETUSER reporter→ shows details for one user ACL DELUSER reporter→ deletes a user ACL LOG → lists recent denied attempts
The Default User
Every fresh server has a user named default with full access and no password. Lock it down by setting a strong password or by turning it off after you create an administrator.
127.0.0.1:6379> ACL SETUSER admin on >LongRandomAdminPass ~* &* +@all OK 127.0.0.1:6379> ACL SETUSER default off OK
Saving ACL Rules
Rules created with ACL SETUSER live in memory. Save them in an ACL file so they survive a restart.
# redis.conf aclfile /etc/redis/users.acl 127.0.0.1:6379> ACL SAVE OK
New Categories in Redis 8
Redis 8 adds command categories for its built-in features: @search, @json, @timeseries, @bloom, @cuckoo, @cms, @topk, and @tdigest. The new commands also join broad categories such as @read and @write. Review existing rules after an upgrade, and grant or block the new categories on purpose.
127.0.0.1:6379> ACL SETUSER catalog on >S3cretPass ~product:* +@read +@json +@search OK
Practical Example – Three Users for One Shop
shopapp on >pass1 ~cart:* ~product:* +@read +@write -@dangerous reporter on >pass2 ~stats:* +@read admin on >pass3 ~* &* +@all Result: The shop app cannot flush the database. The reporter cannot change any data. Only the admin runs maintenance commands.
Key Points
- ACL users carry their own passwords and permissions.
- Rules control commands, categories, key patterns, and channels.
- Give each application the smallest set of rights it needs.
- Disable or secure the default user.
- ACL LOG reveals denied attempts that may signal trouble.