{
  "id": "redis-acl-overview",
  "title": "Overview of Redis ACLs in Redis Software",
  "url": "https://redis.io/docs/latest/operate/rs/8.0/security/access-control/redis-acl-overview/",
  "summary": "An overview of Redis ACLs, syntax, and ACL command support in Redis Software.",
  "content": "\nRedis access control lists (Redis ACLs) allow you to define named permissions for specific Redis commands, keys, and pub/sub channels. You can use defined Redis ACLs for multiple databases and roles.\n\n## Predefined Redis ACLs\n\nRedis Software provides one predefined Redis ACL named **Full Access**. This ACL allows all commands on all keys and cannot be edited.\n\n## Redis ACL syntax\n\nRedis ACLs are defined by a set of rules where you specify the commands or command categories that are allowed for specific keys.\n\n### Commands and categories\n\nRedis ACL rules can allow or block specific [Redis commands](https://redis.io/docs/latest/commands) or [command categories](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#command-categories).\n\n- `+` includes commands\n\n- `-` excludes commands\n\n- `+@` includes command categories\n\n- `-@` excludes command categories\n\nThe following example allows all `read` commands and the `SET` command:\n\n```sh\n+@read +SET\n```\n\nFor database versions earlier than Redis 8.2, module commands have several ACL limitations:\n\n- [Redis modules](https://redis.io/docs/latest/operate/oss_and_stack/stack-with-enterprise) do not have command categories.\n\n- Other [command category](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#command-categories) ACLs, such as `+@read` and `+@write`, do not include Redis module commands. `+@all` is the only exception because it allows all Redis commands.\n\n- You have to include individual module commands in a Redis ACL rule to allow them.\n\n    For example, the following Redis ACL rule allows read-only commands and the Redis Search commands `FT.INFO` and `FT.SEARCH`:\n\n    ```sh\n    +@read +FT.INFO +FT.SEARCH\n    ```\n\n### Key patterns\n\nTo define access to specific keys or key patterns, use the following prefixes:\n\n- `~` or `%RW~` allows read and write access to keys.\n\n- `%R~` allows read access to keys.\n\n- `%W~` allows write access to keys.\n\n`%RW~`, `%R~`, and `%W~` are only supported for databases with Redis version 7.2 or later.\n\nThe following example allows read and write access to all keys that start with \"app1\" and read-only access to all keys that start with \"app2\":\n\n```sh\n~app1* %R~app2*\n```\n\n### Pub/sub channels\n\nThe `\u0026` prefix allows access to [pub/sub channels](https://redis.io/docs/latest/develop/pubsub) (only supported for databases with Redis version 6.2 or later).\n\nTo limit access to specific channels, include `resetchannels` before the allowed channels:\n\n```sh\nresetchannels \u0026channel1 \u0026channel2\n```\n\n### Selectors\n\n[Selectors](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl#selectors) let you define multiple sets of rules in a single Redis ACL (only supported for databases with Redis version 7.2 or later). A command is allowed if it matches the base rule or any selector in the Redis ACL.\n\n- `(\u003crule set\u003e)` creates a new selector.\n\n- `clearselectors` deletes all existing selectors for a user. This action does not delete the base ACL rule.\n\nIn the following example, the base rule allows `GET key1` and the selector allows `SET key2`:\n\n```sh\n+GET ~key1 (+SET ~key2)\n```\n\n## Default pub/sub permissions\n\nRedis database version 6.2 introduced pub/sub ACL rules that determine which [pub/sub channels](https://redis.io/docs/latest/develop/pubsub) a user can access.\n\nThe configuration option `acl-pubsub-default`, added in Redis Software version 6.4.2, determines the cluster-wide default level of access for all pub/sub channels. Redis Software uses the following pub/sub permissions by default:\n\n- For versions 6.4.2 and 7.2, `acl-pubsub-default` is permissive (`allchannels` or `\u0026*`) by default to accommodate earlier Redis versions.\n\n- In future versions, `acl-pubsub-default` will change to restrictive (`resetchannels`). Restrictive permissions block all pub/sub channels by default, unless explicitly permitted by an ACL rule.\n\nIf you use ACLs and pub/sub channels, you should review your databases and ACL settings and plan to transition your cluster to restrictive pub/sub permissions in preparation for future Redis Software releases.\n\n### Prepare for restrictive pub/sub permissions\n\nTo secure pub/sub channels and prepare your cluster for future Redis Software releases that default to restrictive pub/sub permissions:\n\n1. Upgrade Redis databases:\n\n    - For Redis Software version 6.4.2, upgrade all databases in the cluster to Redis DB version 6.2.\n    \n    - For Redis Software version 7.2, upgrade all databases in the cluster to Redis DB version 7.2 or 6.2.\n\n1. Create or update ACLs with permissions for specific channels using the `resetchannels \u0026channel` format.\n\n1. Associate the ACLs with relevant databases.\n\n1. Set default pub/sub permissions (`acl-pubsub-default`) to restrictive. See [Change default pub/sub permissions](#change-default-pubsub-permissions) for details.\n\n1. If any issues occur, you can temporarily change the default pub/sub setting back to permissive. Resolve any problematic ACLs before making pub/sub permissions restrictive again.\n\n\nWhen you change the cluster's default pub/sub permissions to restrictive, `\u0026*` is added to the **Full Access** ACL. Before you make this change, consider the following:\n\n- Because pub/sub ACL syntax was added in Redis 6.2, you can't associate the **Full Access** ACL with database versions 6.0 or lower after this change.\n\n- The **Full Access** ACL is not reverted if you change `acl-pubsub-default` to permissive again.\n\n- Every database with the default user enabled uses the **Full Access** ACL.\n\n\n### Change default pub/sub permissions\n\nAs of Redis Software version 6.4.2, you can configure `acl_pubsub_default`, which determines the default pub/sub permissions for all databases in the cluster. You can set `acl_pubsub_default` to the following values:\n\n- `resetchannels` is restrictive and blocks access to all channels by default.\n\n- `allchannels` is permissive and allows access to all channels by default. \n\nTo make default pub/sub permissions restrictive:\n\n1. [Upgrade all databases](https://redis.io/docs/latest/operate/rs/installing-upgrading/upgrading/upgrade-database) in the cluster to Redis version 6.2 or later.\n\n1. Set the default to restrictive (`resetchannels`) using one of the following methods:\n\n    **Cluster Manager UI:**\n\nTo set the default pub/sub permissions using the Cluster Manager UI:\n    \n1. Navigate to **Access Control \u003e Roles \u003e Pub/Sub ACLs** and click **Edit**.\n\n1. Read the warning, then click **Continue**.\n        \n1. For **Default permissions for Pub/Sub ACLs**, select **Restrictive**, then **Save**.\n\n**rladmin:**\n\nTo set the default pub/sub permissions using `rladmin`, run the [`rladmin tune cluster`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/tune#tune-cluster) command:\n\n```sh\nrladmin tune cluster acl_pubsub_default resetchannels\n```\n\n**REST API:**\n\nTo set the default pub/sub permissions using the REST API, use an [update cluster policy](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/cluster/policy#put-cluster-policy) request:\n\n```sh\nPUT /v1/cluster/policy\n{ \"acl_pubsub_default\": \"resetchannels\" }\n```\n\n\n\n## ACL command support\n\nRedis Software does not support certain Redis ACL commands. Instead, you can manage access controls from the Cluster Manager UI.\n\n| Command | Supported |\n|:--------|:----------|\n| [ACL CAT](https://redis.io/docs/latest/commands/acl-cat) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e \n| [ACL DELUSER](https://redis.io/docs/latest/commands/acl-deluser) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL DRYRUN](https://redis.io/docs/latest/commands/acl-dryrun) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e \n| [ACL GENPASS](https://redis.io/docs/latest/commands/acl-genpass) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL GETUSER](https://redis.io/docs/latest/commands/acl-getuser) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e \n| [ACL HELP](https://redis.io/docs/latest/commands/acl-help) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e \n| [ACL LIST](https://redis.io/docs/latest/commands/acl-list) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e \n| [ACL LOAD](https://redis.io/docs/latest/commands/acl-load) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL LOG](https://redis.io/docs/latest/commands/acl-log) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL SAVE](https://redis.io/docs/latest/commands/acl-save) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL SETUSER](https://redis.io/docs/latest/commands/acl-setuser) | \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e| \u003cspan title=\"Not supported\"\u003e\u0026#x274c; Not supported\u003c/span\u003e|  |\n| [ACL USERS](https://redis.io/docs/latest/commands/acl-users) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e |\n| [ACL WHOAMI](https://redis.io/docs/latest/commands/acl-whoami) | \u003cspan title=\"Supported\"\u003e\u0026#x2705; Supported\u003c/span\u003e |\n\n\nRedis ACLs also have the following differences in Redis Software:\n\n- The `MULTI`, `EXEC`, `DISCARD` commands are always allowed, but ACLs are enforced on `MULTI` subcommands.\n\n- Nested selectors are not supported.\n\n    For example, the following selectors are not valid in Redis Software: \u003cnobr\u003e`+GET ~key1 (+SET (+SET ~key2) ~key3)`\u003c/nobr\u003e\n\n- Key and pub/sub patterns do not allow the following characters: `'(', ')'`\n\n- The following password configuration syntax is not supported: `'\u003e', '\u003c', '#!', 'resetpass'`\n\n    To configure passwords in Redis Software, use one of the following methods:\n\n    - [`rladmin cluster reset_password`](https://redis.io/docs/latest/operate/rs/references/cli-utilities/rladmin/cluster/reset_password):\n    \n        ```sh\n        rladmin cluster reset_password \u003cuser email\u003e\n        ```\n\n    - REST API [`PUT /v1/users`](https://redis.io/docs/latest/operate/rs/references/rest-api/requests/users#put-user) request and provide `password`\n\n## See also\n\n[Redis ACL rules](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl)\n",
  "tags": ["docs","operate","rs"],
  "last_updated": "2026-07-23T12:00:25-05:00"
}