{
  "schema_version": 2,
  "id": "operate/rs/security/access-control/redis-acl-overview",
  "title": "Overview of Redis ACLs in Redis Enterprise Software",
  "url": "https://redis.io/docs/latest/operate/rs/7.4/security/access-control/redis-acl-overview/",
  "summary": "An overview of Redis ACLs, syntax, and ACL command support in Redis Enterprise Software.",
  "aliases": ["/operate/rs/security/access-control/rbac/configure-acl/"],
  "content": "\nRedis access control lists (Redis ACLs) allow you to define named permissions for specific Redis commands, keys, and pub/sub channels. You can use defined Redis ACLs for multiple databases and roles.\n\n## Predefined Redis ACLs\n\nRedis Enterprise Software provides one predefined Redis ACL named **Full Access**. This ACL allows all commands on all keys and cannot be edited.\n\n## Redis ACL syntax\n\nRedis ACLs are defined by a [Redis syntax](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl) where you specify the commands or command categories that are allowed for specific keys.\n\n### Commands and categories\n\nRedis ACL rules can allow or block specific [Redis commands](/content/commands) or [command categories](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#command-categories).\n\n- `+` includes commands\n\n- `-` excludes commands\n\n- `+@` includes command categories\n\n- `-@` excludes command categories\n\nThe following example allows all `read` commands and the `SET` command:\n\n```sh\n+@read +SET\n```\n\nModule commands have several ACL limitations:\n\n- [Redis modules](https://redis.io/docs/latest/operate/oss_and_stack/stack-with-enterprise) do not have command categories.\n\n- Other [command category](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#command-categories) ACLs, such as `+@read` and `+@write`, do not include Redis module commands. `+@all` is the only exception because it allows all Redis commands.\n\n- You have to include individual module commands in a Redis ACL rule to allow them.\n\n    For example, the following Redis ACL rule allows read-only commands and the RediSearch commands `FT.INFO` and `FT.SEARCH`:\n\n    ```sh\n    +@read +FT.INFO +FT.SEARCH\n    ```\n\n### Key patterns\n\nTo define access to specific keys or key patterns, use the following prefixes:\n\n- `~` or `%RW~` allows read and write access to keys.\n\n- `%R~` allows read access to keys.\n\n- `%W~` allows write access to keys.\n\n`%RW~`, `%R~`, and `%W~` are only supported for databases with Redis version 7.2 or later.\n\nThe following example allows read and write access to all keys that start with \"app1\" and read-only access to all keys that start with \"app2\":\n\n```sh\n~app1* %R~app2*\n```\n\n### Pub/sub channels\n\nThe `\u0026` prefix allows access to [pub/sub channels](https://redis.io/docs/latest/develop/pubsub) (only supported for databases with Redis version 6.2 or later).\n\nTo limit access to specific channels, include `resetchannels` before the allowed channels:\n\n```sh\nresetchannels \u0026channel1 \u0026channel2\n```\n\n### Selectors\n\n[Selectors](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#selectors) let you define multiple sets of rules in a single Redis ACL (only supported for databases with Redis version 7.2 or later). A command is allowed if it matches the base rule or any selector in the Redis ACL.\n\n- `(\u003crule set\u003e)` creates a new selector.\n\n- `clearselectors` deletes all existing selectors for a user. This action does not delete the base ACL rule.\n\nIn the following example, the base rule allows `GET key1` and the selector allows `SET key2`:\n\n```sh\n+GET ~key1 (+SET ~key2)\n```\n\n## Default pub/sub permissions\n\nRedis database version 6.2 introduced pub/sub ACL rules that determine which [pub/sub channels](https://redis.io/docs/latest/develop/pubsub) a user can access.\n\nThe configuration option `acl-pubsub-default`, added in Redis Enterprise Software version 6.4.2, determines the cluster-wide default level of access for all pub/sub channels. Redis Enterprise Software uses the following pub/sub permissions by default:\n\n- For versions 6.4.2 and 7.2, `acl-pubsub-default` is permissive (`allchannels` or `\u0026*`) by default to accommodate earlier Redis versions.\n\n- In future versions, `acl-pubsub-default` will change to restrictive (`resetchannels`). Restrictive permissions block all pub/sub channels by default, unless explicitly permitted by an ACL rule.\n\nIf you use ACLs and pub/sub channels, you should review your databases and ACL settings and plan to transition your cluster to restrictive pub/sub permissions in preparation for future Redis Enterprise Software releases.\n\n### Prepare for restrictive pub/sub permissions\n\nTo secure pub/sub channels and prepare your cluster for future Redis Enterprise Software releases that default to restrictive pub/sub permissions:\n\n1. Upgrade Redis databases:\n\n    - For Redis Enterprise Software version 6.4.2, upgrade all databases in the cluster to Redis DB version 6.2.\n    \n    - For Redis Enterprise Software version 7.2, upgrade all databases in the cluster to Redis DB version 7.2 or 6.2.\n\n1. Create or update ACLs with permissions for specific channels using the `resetchannels \u0026channel` format.\n\n1. Associate the ACLs with relevant databases.\n\n1. Set default pub/sub permissions (`acl-pubsub-default`) to restrictive. See [Change default pub/sub permissions](#change-default-pubsub-permissions) for details.\n\n1. If any issues occur, you can temporarily change the default pub/sub setting back to permissive. Resolve any problematic ACLs before making pub/sub permissions restrictive again.\n\n\u003e [!NOTE]\n\u003e When you change the cluster's default pub/sub permissions to restrictive, `\u0026*` is added to the **Full Access** ACL. Before you make this change, consider the following:\n\u003e\n\u003e - Because pub/sub ACL syntax was added in Redis 6.2, you can't associate the **Full Access** ACL with database versions 6.0 or lower after this change.\n\u003e\n\u003e - The **Full Access** ACL is not reverted if you change `acl-pubsub-default` to permissive again.\n\u003e\n\u003e - Every database with the default user enabled uses the **Full Access** ACL.\n\n### Change default pub/sub permissions\n\nAs of Redis Enterprise version 6.4.2, you can configure `acl_pubsub_default`, which determines the default pub/sub permissions for all databases in the cluster. You can set `acl_pubsub_default` to the following values:\n\n- `resetchannels` is restrictive and blocks access to all channels by default.\n\n- `allchannels` is permissive and allows access to all channels by default. \n\nTo make default pub/sub permissions restrictive:\n\n1. [Upgrade all databases](https://redis.io/docs/latest/operate/rs/installing-upgrading/upgrading/upgrade-database) in the cluster to Redis version 6.2 or later.\n\n1. Set the default to restrictive (`resetchannels`) using one of the following methods:\n\n    - New Cluster Manager UI (only available for Redis Enterprise versions 7.2 and later):\n    \n        1. Navigate to **Access Control \u003e Settings \u003e Pub/Sub ACLs** and select **Edit**.\n        \n        1. For **Default permissions for Pub/Sub ACLs**, select **Restrictive**, then **Save**.\n\n    - [`rladmin tune cluster`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/tune#tune-cluster):\n\n        ```sh\n        rladmin tune cluster acl_pubsub_default resetchannels\n        ```\n\n    - [Update cluster policy](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster/policy#put-cluster-policy) REST API request:\n\n        ```sh\n        PUT /v1/cluster/policy\n        { \"acl_pubsub_default\": \"resetchannels\" }\n        ```\n\n## ACL command support\n\nRedis Enterprise Software does not support certain Redis ACL commands. Instead, you can manage access controls from the Cluster Manager UI.\n\n| Command | Supported |\n|:--------|:----------|\n| [ACL CAT](https://redis.io/docs/latest/commands/acl-cat) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e \n| [ACL DELUSER](https://redis.io/docs/latest/commands/acl-deluser) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL DRYRUN](https://redis.io/docs/latest/commands/acl-dryrun) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e \n| [ACL GENPASS](https://redis.io/docs/latest/commands/acl-genpass) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL GETUSER](https://redis.io/docs/latest/commands/acl-getuser) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e \n| [ACL HELP](https://redis.io/docs/latest/commands/acl-help) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e \n| [ACL LIST](https://redis.io/docs/latest/commands/acl-list) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e \n| [ACL LOAD](https://redis.io/docs/latest/commands/acl-load) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL LOG](https://redis.io/docs/latest/commands/acl-log) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL SAVE](https://redis.io/docs/latest/commands/acl-save) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL SETUSER](https://redis.io/docs/latest/commands/acl-setuser) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL USERS](https://redis.io/docs/latest/commands/acl-users) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e |\n| [ACL WHOAMI](https://redis.io/docs/latest/commands/acl-whoami) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e |\n\n\nRedis ACLs also have the following differences in Redis Enterprise Software:\n\n- The `MULTI`, `EXEC`, `DISCARD` commands are always allowed, but ACLs are enforced on `MULTI` subcommands.\n\n- Nested selectors are not supported.\n\n    For example, the following selectors are not valid in Redis Enterprise: \u003cnobr\u003e`+GET ~key1 (+SET (+SET ~key2) ~key3)`\u003c/nobr\u003e\n\n- Key and pub/sub patterns do not allow the following characters: `'(', ')'`\n\n- The following password configuration syntax is not supported: `'\u003e', '\u003c', '#!', 'resetpass'`\n\n    To configure passwords in Redis Enterprise Software, use one of the following methods:\n\n    - [`rladmin cluster reset_password`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/reset_password):\n    \n        ```sh\n        rladmin cluster reset_password \u003cuser email\u003e\n        ```\n\n    - REST API [`PUT /v1/users`](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/users#put-user) request and provide `password`\n\n",
  "tags": ["docs","operate","rs"],
  "last_updated": "2026-10-21T09:46:20-07:00"
}