{
  "schema_version": 2,
  "id": "operate/rc/security/access-control/data-access-control/configure-acls",
  "title": "Configure permissions with Redis ACLs",
  "url": "https://redis.io/docs/latest/operate/rc/security/access-control/data-access-control/configure-acls/",
  "summary": "",
  "tags": [
    "docs",
    "operate",
    "rc"
  ],
  "last_updated": "2026-10-01T14:41:35+01:00",
  "page_type": "content",
  "content_hash": "50b7a59975bcbad7da4974a9fbbd0edb5d2934be35a0b3f1c5cc49cddc3592d6",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "You can define custom Redis ACL rules to assign to a data access role or use predefined Redis ACLs.\n\nRedis provides three predefined ACL rules, which are marked with the Redis logo and can not be changed:\n\n- **Full-Access**: Allows all commands. \n- **Read-Write**: Allows read and write commands and excludes dangerous commands.\n- **Read-Only**: Allows read commands only.\n\nACLs that are not marked with the Redis logo are user-defined ACL rules.\n\nTo configure a Redis ACL that you can assign to a data access role:\n\n1. Go to **Data Access Control** from the [Redis Cloud console](https://cloud.redis.io/#/) menu.\n\n    ![Menu for database access control.](https://redis.io/docs/latest/images/rc/data-access-control-menu.png)\n\n1. Select the **Redis ACLs** tab.\n\n    ![Redis ACLs area.](https://redis.io/docs/latest/images/rc/data-access-control-redis-acls.png)\n\n1. Either select `+` to create a new Redis ACL or point to an existing ACL and select the pencil icon to edit it.\n\n    ![Add or Update Redis ACL.](https://redis.io/docs/latest/images/rc/data-access-control-redis-acls-add-or-update.png)\n\n    > [!NOTE]\n    > The built-in Redis ACLs can't be edited.\n\n1. Provide a descriptive name and create the ACL rule [using ACL syntax](#define-permissions-with-acl-syntax).\n\n    ![Add Redis ACL.](https://redis.io/docs/latest/images/rc/data-access-control-redis-acls-add.png)\n\n1. Select the check mark to save your changes.  Your new Redis ACL should appear in the list.\n\n    ![Saved Redis ACL.](https://redis.io/docs/latest/images/rc/data-access-control-redis-acls-saved.png)\n\nAfter you create a Redis ACL, you can assign it to a role. Redis ACLs are not fully verified until they are assigned to a role. For more information, see [Create roles](https://redis.io/docs/latest/operate/rc/security/access-control/data-access-control/create-roles) or [Active-Active access roles](https://redis.io/docs/latest/operate/rc/security/access-control/data-access-control/active-active-roles) for an [Active-Active database](https://redis.io/docs/latest/operate/rc/databases/active-active)."
    },
    {
      "id": "define-permissions-with-acl-syntax",
      "title": "Define permissions with ACL syntax",
      "role": "content",
      "text": "You can define these permissions using the [Redis ACL syntax](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#acl-rules). This syntax lets you concisely specify which commands, command categories, keys, and pub/sub channels to allow.\n\n- `+` *includes* commands or command categories\n- `-` *excludes* commands or command categories\n- `@` indicates a command category\n- `~` defines a permitted key pattern\n- `&` allows access to a [pub/sub channel](https://redis.io/docs/latest/develop/pubsub)\n\nThe Redis Cloud console will validate your ACL syntax while you are typing."
    },
    {
      "id": "command-acl-rules",
      "title": "Command ACL rules",
      "role": "syntax",
      "text": "A **command** can be any [Redis command](/content/commands).\n\nFor example, this Redis ACL rule indicates that the `SET` command is permitted:\n\n[code example]"
    },
    {
      "id": "command-category-acl-rules",
      "title": "Command category ACL rules",
      "role": "syntax",
      "text": "A [**command category**](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#command-categories) is a predefined, named set of commands.\n\nFor example, the Redis commands that\nread data are available in the `read` command category. This Redis ACL rule permits access to all read commands:\n\n[code example]\n\nTo find out which commands are included in the\n`read` command category, run the following command with [`redis-cli`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/redis-cli):\n\n[code example]"
    },
    {
      "id": "key-acl-rules",
      "title": "Key ACL rules",
      "role": "content",
      "text": "To specify which **keys** are accessible, use the [key permissions syntax](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#key-permissions).\n\nThe following ACL rule allows access to all keys:\n\n[code example]\n\nWhereas, this ACL rule only allows access to keys prefixed with `cache:`\n\n[code example]\n\nStarting with Redis 7.0, key patterns can also be used to define how a command is able to read or write a key.\n\nThe following ACL rule allows you to copy information from keys prefixed with `cache:` into keys prefixed with `app:`:\n\n[code example]\n\nFor more information on how this works, see the [key permissions syntax](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#key-permissions)."
    },
    {
      "id": "pubsub-acl-rules",
      "title": "Pub/sub ACL rules",
      "role": "content",
      "text": "Pub/sub ACL rules determine which pub/sub channels a user can access. For more information see, [Redis pub/sub](https://redis.io/docs/latest/develop/pubsub)\n\nFor versions older than Redis 7.0, pub/sub is permissive and allows access to all channels by default.\n\nRedis 7.0 makes pub/sub restrictive and blocks access to all channels in Redis Software. However, Redis Cloud still defaults to permissive pub/sub even for Redis 7.0 subscriptions.\n\n| Redis<br />version | Redis Open Source<br />pub/sub ACLs | Redis Cloud<br />pub/sub ACLs |\n|:-------------:|-----------|-------------|\n| 6.0 | Not supported | Not supported |\n| 6.2 | Permissive | Permissive |\n| 7.0 | Restrictive | Permissive |\n\n#### Restrict channel access\n\nTo block access to all channels, use the following ACL rule:\n\n[code example]\n\nIf you want to limit access to specific channels, first include `resetchannels`. Then use `&` syntax to allow access to particular channels:\n\n[code example]\n\n#### Allow all channels\n\nTo make pub/sub explicitly permissive and allow users to access all channels, set the following rule:\n\n[code example]"
    },
    {
      "id": "selectors",
      "title": "Selectors",
      "role": "content",
      "text": "Starting with Redis 7.0, Redis supports adding multiple sets of rules that are evaluated independently of each other, called [selectors](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#selectors). \n\nThe following ACL rule allows a user to execute `GET` on keys prefixed with `cache` and `SET` on keys prefixed with `app`:\n\n[code example]"
    },
    {
      "id": "predefined-permissions",
      "title": "Predefined permissions",
      "role": "content",
      "text": "Redis Cloud includes three predefined permissions:\n\n- Full-Access (`+@all ~*`) - All commands are allowed for all keys.\n\n- Read-Write (`+@all -@dangerous ~*`) - All commands except for the `dangerous` command category are allowed for all keys.\n\n- Read-Only (`+@read ~*`) - Only the `read` command category is allowed for all keys."
    },
    {
      "id": "advanced-capability-command-permissions",
      "title": "Advanced capability command permissions",
      "role": "content",
      "text": "Note that you can define permissions for the Redis commands of any advanced capabilities that are part of your subscription;\nhowever, these permissions can only be used for databases that support those capabilities."
    }
  ],
  "examples": [
    {
      "id": "command-acl-rules-ex0",
      "language": "sh",
      "code": "+set",
      "section_id": "command-acl-rules"
    },
    {
      "id": "command-category-acl-rules-ex0",
      "language": "sh",
      "code": "+@read",
      "section_id": "command-category-acl-rules"
    },
    {
      "id": "command-category-acl-rules-ex1",
      "language": "sh",
      "code": "ACL CAT read",
      "section_id": "command-category-acl-rules"
    },
    {
      "id": "key-acl-rules-ex0",
      "language": "sh",
      "code": "~*",
      "section_id": "key-acl-rules"
    },
    {
      "id": "key-acl-rules-ex1",
      "language": "plaintext",
      "code": "~cache:*",
      "section_id": "key-acl-rules"
    },
    {
      "id": "key-acl-rules-ex2",
      "language": "text",
      "code": "+@all ~app:* %R~cache:*",
      "section_id": "key-acl-rules"
    },
    {
      "id": "pubsub-acl-rules-ex0",
      "language": "sh",
      "code": "resetchannels",
      "section_id": "pubsub-acl-rules"
    },
    {
      "id": "pubsub-acl-rules-ex1",
      "language": "sh",
      "code": "resetchannels &channel1 &channel2",
      "section_id": "pubsub-acl-rules"
    },
    {
      "id": "pubsub-acl-rules-ex2",
      "language": "sh",
      "code": "allchannels",
      "section_id": "pubsub-acl-rules"
    },
    {
      "id": "selectors-ex0",
      "language": "text",
      "code": "+GET ~cache:* (+SET ~app:*)",
      "section_id": "selectors"
    }
  ]
}