Redis ACL Explained: Managing Users and Permissions in Redis

Introduction

Redis Access Control Lists (ACLs) provide a flexible way to manage authentication and authorization for Redis users.

Introduced in Redis 6, ACLs replace the traditional single-password authentication model with a user-based security system. Instead of sharing one password for every client, administrators can create multiple users, assign different passwords, and restrict which commands or keys each user can access.

This guide explains how Redis ACLs work, how to configure users and permissions, and best practices for securing production environments.

What Is Redis ACL?

Before Redis 6, authentication was handled using a single password configured with:

requirepass MyPassword

Every client shared the same credentials.

With ACLs, Redis supports:

Multiple users

Multiple passwords

Command-level permissions

Key pattern restrictions

User enable/disable controls

This makes Redis significantly more secure for multi-user and enterprise environments.

Default User

Redis includes a built-in user named:

default

View ACL information:

redis-cli ACL LIST

Example output:

user default on nopass ~* &* +@all

Create a User

Create a read-only user:

ACL SETUSER readonly on >StrongPassword123 ~* +@read

This command:

Enables the user

Sets a password

Allows access to all keys

Grants read-only commands

Create a Read/Write User

Example:

ACL SETUSER appuser on >MyPassword ~* +@all

The user can execute all command categories.

Disable a User

ACL SETUSER appuser off

The user can no longer authenticate.

Delete a User

ACL DELUSER appuser

Authenticate as a User

Instead of using only a password:

AUTH username password

Example:

AUTH readonly StrongPassword123

Using redis-cli:

redis-cli --user readonly --pass StrongPassword123

Restrict Commands

Allow only read commands:

ACL SETUSER analytics on >password +@read

Allow only write commands:

ACL SETUSER writer on >password +@write

Deny dangerous commands:

ACL SETUSER appuser -FLUSHALL -FLUSHDB

This prevents accidental deletion of all data.

Restrict Keys

Allow access only to application keys:

ACL SETUSER appuser ~app:*

Examples:

Allowed:

app:user:1001

Denied:

admin:user:1001

Key patterns help isolate applications sharing the same Redis instance.

ACL Categories

Redis groups commands into categories.

Examples include:

| Category     | Description             |
| ------------ | ----------------------- |
| `@read`      | Read-only commands      |
| `@write`     | Write commands          |
| `@admin`     | Administrative commands |
| `@keyspace`  | Key management          |
| `@dangerous` | High-risk commands      |
| `@all`       | All command categories  |

ACL vs requirepass

| Feature              | ACL | requirepass |
| -------------------- | --- | ----------- |
| Multiple users       | ✅   | ❌           |
| Multiple passwords   | ✅   | ❌           |
| Command permissions  | ✅   | ❌           |
| Key restrictions     | ✅   | ❌           |
| Redis 6+ recommended | ✅   | Limited     |

For new deployments, ACLs are generally the preferred authentication mechanism.

Common Mistakes

Granting All Permissions

+@all

should be used only for trusted administrative accounts.

Forgetting Key Restrictions

If every user can access every key:

~*

there is little isolation between applications.

Sharing One Administrative Account

Creating separate users for applications, administrators, and monitoring tools improves security and simplifies auditing.

Best Practices

Use ACLs instead of requirepass for Redis 6 and later.

Create separate users for different applications and services.

Follow the principle of least privilege by granting only the permissions each user requires.

Restrict access to specific key patterns whenever possible.

Disable or remove unused accounts.

Continue to protect Redis with bind, protected-mode, and firewall rules in addition to ACLs.

Related Articles

Redis Explained

Redis requirepass Explained

Redis protected-mode Explained

Redis bind Explained

Redis port Explained

Conclusion

Redis ACLs provide a modern, flexible security model by allowing multiple users with individual passwords, command permissions, and key access restrictions. Compared with the older requirepass approach, ACLs offer much finer control and are better suited to production environments where different applications or administrators require different levels of access.

For Redis 6 and later, ACLs are the recommended approach to authentication and authorization, especially when combined with proper network configuration and other security best practices.