Create roles with cluster access only

Create roles with cluster access only.

Redis Software

Roles with cluster access allow access to the Cluster Management UI and REST API.

Default management roles

Redis Software includes five predefined roles that determine a user's level of access to the Cluster Manager UI and REST API.

  1. DB Viewer - Read database settings
  2. DB Member - Administer databases
  3. Cluster Viewer - Read cluster settings
  4. Cluster Member - Administer the cluster
  5. User Manager - Administer users
  6. Admin - Full cluster access
  7. None - For data access only - cannot access the Cluster Manager UI or use the REST API

For more details about the privileges granted by each of these roles, see Cluster Manager UI permissions or REST API permissions.

Cluster Manager UI permissions

Here's a summary of the Cluster Manager UI actions permitted by each default management role:

Action DB Viewer DB Member Cluster Viewer Cluster Member Admin User Manager
Create, edit, delete users and LDAP mappings ❌ No ❌ No ❌ No ❌ No ✅ Yes ✅ Yes
Create support package ❌ No ✅ Yes ❌ No ✅ Yes ✅ Yes ❌ No
Edit database configuration ❌ No ✅ Yes ❌ No ✅ Yes ✅ Yes ❌ No
Reset slow log ❌ No ✅ Yes ❌ No ✅ Yes ✅ Yes ❌ No
View cluster configuration ❌ No ❌ No ✅ Yes ✅ Yes ✅ Yes ✅ Yes
View cluster logs ❌ No ✅ Yes ✅ Yes ✅ Yes ✅ Yes
 ✅ Yes
View cluster metrics ❌ No ❌ No ✅ Yes ✅ Yes ✅ Yes ✅ Yes
View database configuration ✅ Yes ✅ Yes ✅ Yes ✅ Yes ✅ Yes ✅ Yes
View database metrics ✅ Yes ✅ Yes ✅ Yes ✅ Yes ✅ Yes ✅ Yes
View node configuration ❌ No ❌ No ✅ Yes ✅ Yes ✅ Yes ✅ Yes
View node metrics ❌ No ❌ No ✅ Yes ✅ Yes ✅ Yes ✅ Yes
View Redis database password ❌ No ✅ Yes ❌ No ✅ Yes ✅ Yes ✅ Yes
View slow log ❌ No ✅ Yes ❌ No ✅ Yes ✅ Yes ❌ No
View and edit cluster settings ❌ No ❌ No ❌ No ❌ No ✅ Yes ❌ No

Create roles for cluster access

You can use the Cluster Manager UI or the REST API to create a role that grants cluster access but does not grant access to any databases.

To create a role that grants cluster access using the Cluster Manager UI:

  1. From Access Control > Roles, you can:

    • Select a role from the list of existing roles to edit it.

    • Click + Add role to create a new role.

    Add role with name

  2. Enter a descriptive name for the role.

  3. Choose a Management role to determine cluster management permissions.

    Select a cluster management role to set the level of cluster management permissions for the new role.

  4. To prevent database access when using this role, do not add any ACLs.

  5. Click Save.

You can assign the new role to users to grant cluster access.

Scope a role to specific databases

By default, the db_member and db_viewer management roles grant access to every database in the cluster. In a shared or multi-tenant cluster, you can scope one of these roles to specific databases so that users assigned the role can view or manage only those databases.

To scope a role, add the resources field when you create or update a role with the REST API. The resources field is a list of resource scopes; each scope has a type (currently only db) and a uids array of the database IDs the role applies to.

For example, the following request creates a db_member role scoped to databases 1 and 2:

POST /v1/roles
{
  "name": "team-a-dbs",
  "management": "db_member",
  "resources": [
    { "type": "db", "uids": ["1", "2"] }
  ]
}

When you assign this role to a user:

  • The user can view or manage only the databases listed in the role's resources scope.

  • In the Cluster Manager UI and REST API responses, the user sees only their authorized databases, including in database lists, metrics, alerts, and event logs. Other databases are hidden.

To return a role to cluster-wide scope, update it with an empty resources list or omit the field. Roles without a resources scope apply to all databases, so existing roles are unaffected.

Note:
Database scoping applies to the db_member and db_viewer management roles.
RATE THIS PAGE
Back to top ↑