{ "schema_version": 2, "id": "operate/rs/security/access-control/redis-acl-overview", "title": "Overview of Redis ACLs in Redis Software", "url": "https://redis.io/docs/latest/operate/rs/security/access-control/redis-acl-overview/", "summary": "An overview of Redis ACLs, syntax, and ACL command support in Redis Software.", "tags": [ "docs", "operate", "rs" ], "last_updated": "2026-09-24T14:53:09+01:00", "page_type": "content", "content_hash": "e892ef278b1b713e2012d49bd4a949b7313def78b2fcad03b5ba2e156e62100f", "sections": [ { "id": "overview", "title": "Overview", "role": "overview", "text": "Redis access control lists (Redis ACLs) allow you to define named permissions for specific Redis commands, keys, and pub/sub channels. You can use defined Redis ACLs for multiple databases and roles." }, { "id": "predefined-redis-acls", "title": "Predefined Redis ACLs", "role": "content", "text": "Redis Software provides one predefined Redis ACL named **Full Access**. This ACL allows all commands on all keys and cannot be edited." }, { "id": "redis-acl-syntax", "title": "Redis ACL syntax", "role": "content", "text": "Redis ACLs are defined by a set of rules where you specify the commands or command categories that are allowed for specific keys." }, { "id": "commands-and-categories", "title": "Commands and categories", "role": "syntax", "text": "Redis ACL rules can allow or block specific [Redis commands](/content/commands) or [command categories](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#command-categories).\n\n- `+` includes commands\n\n- `-` excludes commands\n\n- `+@` includes command categories\n\n- `-@` excludes command categories\n\nThe following example allows all `read` commands and the `SET` command:\n\n[code example]\n\nFor database versions earlier than Redis 8.2, module commands have several ACL limitations:\n\n- [Redis modules](https://redis.io/docs/latest/operate/oss_and_stack/stack-with-enterprise) do not have command categories.\n\n- Other [command category](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#command-categories) ACLs, such as `+@read` and `+@write`, do not include Redis module commands. `+@all` is the only exception because it allows all Redis commands.\n\n- You have to include individual module commands in a Redis ACL rule to allow them.\n\n For example, the following Redis ACL rule allows read-only commands and the Redis Search commands `FT.INFO` and `FT.SEARCH`:\n\n [code example]" }, { "id": "key-patterns", "title": "Key patterns", "role": "content", "text": "To define access to specific keys or key patterns, use the following prefixes:\n\n- `~` or `%RW~` allows read and write access to keys.\n\n- `%R~` allows read access to keys.\n\n- `%W~` allows write access to keys.\n\n`%RW~`, `%R~`, and `%W~` are only supported for databases with Redis version 7.2 or later.\n\nThe following example allows read and write access to all keys that start with \"app1\" and read-only access to all keys that start with \"app2\":\n\n[code example]" }, { "id": "pubsub-channels", "title": "Pub/sub channels", "role": "content", "text": "The `&` prefix allows access to [pub/sub channels](https://redis.io/docs/latest/develop/pubsub) (only supported for databases with Redis version 6.2 or later).\n\nTo limit access to specific channels, include `resetchannels` before the allowed channels:\n\n[code example]" }, { "id": "selectors", "title": "Selectors", "role": "content", "text": "[Selectors](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#selectors) let you define multiple sets of rules in a single Redis ACL (only supported for databases with Redis version 7.2 or later). A command is allowed if it matches the base rule or any selector in the Redis ACL.\n\n- `()` creates a new selector.\n\n- `clearselectors` deletes all existing selectors for a user. This action does not delete the base ACL rule.\n\nIn the following example, the base rule allows `GET key1` and the selector allows `SET key2`:\n\n[code example]" }, { "id": "default-pubsub-permissions", "title": "Default pub/sub permissions", "role": "content", "text": "Redis database version 6.2 introduced pub/sub ACL rules that determine which [pub/sub channels](https://redis.io/docs/latest/develop/pubsub) a user can access.\n\nThe configuration option `acl-pubsub-default`, added in Redis Software version 6.4.2, determines the cluster-wide default level of access for all pub/sub channels. Redis Software uses the following pub/sub permissions by default:\n\n- For versions 6.4.2 and 7.2, `acl-pubsub-default` is permissive (`allchannels` or `&*`) by default to accommodate earlier Redis versions.\n\n- In future versions, `acl-pubsub-default` will change to restrictive (`resetchannels`). Restrictive permissions block all pub/sub channels by default, unless explicitly permitted by an ACL rule.\n\nIf you use ACLs and pub/sub channels, you should review your databases and ACL settings and plan to transition your cluster to restrictive pub/sub permissions in preparation for future Redis Software releases." }, { "id": "prepare-for-restrictive-pubsub-permissions", "title": "Prepare for restrictive pub/sub permissions", "role": "content", "text": "To secure pub/sub channels and prepare your cluster for future Redis Software releases that default to restrictive pub/sub permissions:\n\n1. Upgrade Redis databases:\n\n - For Redis Software version 6.4.2, upgrade all databases in the cluster to Redis DB version 6.2.\n \n - For Redis Software version 7.2, upgrade all databases in the cluster to Redis DB version 7.2 or 6.2.\n\n1. Create or update ACLs with permissions for specific channels using the `resetchannels &channel` format.\n\n1. Associate the ACLs with relevant databases.\n\n1. Set default pub/sub permissions (`acl-pubsub-default`) to restrictive. See [Change default pub/sub permissions](#change-default-pubsub-permissions) for details.\n\n1. If any issues occur, you can temporarily change the default pub/sub setting back to permissive. Resolve any problematic ACLs before making pub/sub permissions restrictive again.\n\n> [!NOTE]\n> When you change the cluster's default pub/sub permissions to restrictive, `&*` is added to the **Full Access** ACL. Before you make this change, consider the following:\n>\n> - Because pub/sub ACL syntax was added in Redis 6.2, you can't associate the **Full Access** ACL with database versions 6.0 or lower after this change.\n>\n> - The **Full Access** ACL is not reverted if you change `acl-pubsub-default` to permissive again.\n>\n> - Every database with the default user enabled uses the **Full Access** ACL." }, { "id": "change-default-pubsub-permissions", "title": "Change default pub/sub permissions", "role": "content", "text": "As of Redis Software version 6.4.2, you can configure `acl_pubsub_default`, which determines the default pub/sub permissions for all databases in the cluster. You can set `acl_pubsub_default` to the following values:\n\n- `resetchannels` is restrictive and blocks access to all channels by default.\n\n- `allchannels` is permissive and allows access to all channels by default. \n\nTo make default pub/sub permissions restrictive:\n\n1. [Upgrade all databases](https://redis.io/docs/latest/operate/rs/installing-upgrading/upgrading/upgrade-database) in the cluster to Redis version 6.2 or later.\n\n1. Set the default to restrictive (`resetchannels`) using one of the following methods:\n\n **Cluster Manager UI:**\n\nTo set the default pub/sub permissions using the Cluster Manager UI:\n \n1. Navigate to **Access Control > Roles > Pub/Sub ACLs** and click **Edit**.\n\n1. Read the warning, then click **Continue**.\n \n1. For **Default permissions for Pub/Sub ACLs**, select **Restrictive**, then **Save**.\n\n**rladmin:**\n\nTo set the default pub/sub permissions using `rladmin`, run the [`rladmin tune cluster`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/tune#tune-cluster) command:\n\n[code example]\n\n**REST API:**\n\nTo set the default pub/sub permissions using the REST API, use an [update cluster policy](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster/policy#put-cluster-policy) request:\n\n[code example]" }, { "id": "acl-command-support", "title": "ACL command support", "role": "security", "text": "Redis Software does not support certain Redis ACL commands. Instead, you can manage access controls from the Cluster Manager UI.\n\n| Command | Supported |\n|:--------|:----------|\n| [ACL CAT](https://redis.io/docs/latest/commands/acl-cat) | ✅ Supported | ✅ Supported \n| [ACL DELUSER](https://redis.io/docs/latest/commands/acl-deluser) | ❌ Not supported| ❌ Not supported| |\n| [ACL DRYRUN](https://redis.io/docs/latest/commands/acl-dryrun) | ✅ Supported | ✅ Supported \n| [ACL GENPASS](https://redis.io/docs/latest/commands/acl-genpass) | ❌ Not supported| ❌ Not supported| |\n| [ACL GETUSER](https://redis.io/docs/latest/commands/acl-getuser) | ✅ Supported | ✅ Supported \n| [ACL HELP](https://redis.io/docs/latest/commands/acl-help) | ✅ Supported | ✅ Supported \n| [ACL LIST](https://redis.io/docs/latest/commands/acl-list) | ✅ Supported | ✅ Supported \n| [ACL LOAD](https://redis.io/docs/latest/commands/acl-load) | ❌ Not supported| ❌ Not supported| |\n| [ACL LOG](https://redis.io/docs/latest/commands/acl-log) | ❌ Not supported| ❌ Not supported| |\n| [ACL SAVE](https://redis.io/docs/latest/commands/acl-save) | ❌ Not supported| ❌ Not supported| |\n| [ACL SETUSER](https://redis.io/docs/latest/commands/acl-setuser) | ❌ Not supported| ❌ Not supported| |\n| [ACL USERS](https://redis.io/docs/latest/commands/acl-users) | ✅ Supported |\n| [ACL WHOAMI](https://redis.io/docs/latest/commands/acl-whoami) | ✅ Supported |\n\n\nRedis ACLs also have the following differences in Redis Software:\n\n- The `MULTI`, `EXEC`, `DISCARD` commands are always allowed, but ACLs are enforced on `MULTI` subcommands.\n\n- Nested selectors are not supported.\n\n For example, the following selectors are not valid in Redis Software: `+GET ~key1 (+SET (+SET ~key2) ~key3)`\n\n- Key and pub/sub patterns do not allow the following characters: `'(', ')'`\n\n- The following password configuration syntax is not supported: `'>', '<', '#!', 'resetpass'`\n\n To configure passwords in Redis Software, use one of the following methods:\n\n - [`rladmin cluster reset_password`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/reset_password):\n \n [code example]\n\n - REST API [`PUT /v1/users`](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/users#put-user) request and provide `password`" }, { "id": "see-also", "title": "See also", "role": "related", "text": "[Redis ACL rules](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl)" } ], "examples": [ { "id": "commands-and-categories-ex0", "language": "sh", "code": "+@read +SET", "section_id": "commands-and-categories" }, { "id": "commands-and-categories-ex1", "language": "sh", "code": "+@read +FT.INFO +FT.SEARCH", "section_id": "commands-and-categories" }, { "id": "key-patterns-ex0", "language": "sh", "code": "~app1* %R~app2*", "section_id": "key-patterns" }, { "id": "pubsub-channels-ex0", "language": "sh", "code": "resetchannels &channel1 &channel2", "section_id": "pubsub-channels" }, { "id": "selectors-ex0", "language": "sh", "code": "+GET ~key1 (+SET ~key2)", "section_id": "selectors" }, { "id": "change-default-pubsub-permissions-ex0", "language": "sh", "code": "rladmin tune cluster acl_pubsub_default resetchannels", "section_id": "change-default-pubsub-permissions" }, { "id": "change-default-pubsub-permissions-ex1", "language": "sh", "code": "PUT /v1/cluster/policy\n{ \"acl_pubsub_default\": \"resetchannels\" }", "section_id": "change-default-pubsub-permissions" }, { "id": "acl-command-support-ex0", "language": "sh", "code": "rladmin cluster reset_password ", "section_id": "acl-command-support" } ] }