ACL rules and categories in Redis - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What is the output of this ACL command?

Given the ACL rule ACL SETUSER alice on >password ~* +@all, what will be the result of the command ACL LIST for user alice?

Redis

ACL LIST

A user alice on >password ~* +@all

B user alice off >password ~* +@all

C user alice on >password ~* -@all

D user alice on >password ~* +@read

💡 Hint

Remember that on means the user is enabled and +@all grants all command categories.

The ACL rule enables user alice with password authentication, allows access to all keys (~*), and grants all command categories (+@all).

🧠 Conceptual

intermediate

Which ACL category allows keyspace notifications commands?

In Redis ACL categories, which category includes commands related to keyspace notifications?

A @admin

B @read

C @pubsub

D @keyspace

💡 Hint

Keyspace notifications use the publish/subscribe system.

The @pubsub category includes commands related to publish/subscribe messaging, which covers keyspace notifications.

📝 Syntax

advanced

Which ACL SETUSER command syntax is valid to allow only read commands on keys starting with 'cache:'?

Select the correct ACL SETUSER command that enables a user with password 'secret', allows only read commands, and restricts keys to those starting with 'cache:'.

A ACL SETUSER bob on >secret ~cache:* +@read

B ACL SETUSER bob on >secret ~cache:* +@write

C ACL SETUSER bob on >secret ~cache:* +@all

D ACL SETUSER bob on >secret ~cache* +@read

💡 Hint

The key pattern must end with a colon and asterisk to match keys starting with 'cache:'.

Option A correctly uses the pattern '~cache:*' to restrict keys and '+@read' to allow only read commands.

🔧 Debug

advanced

Why does this ACL rule fail to restrict commands properly?

Consider the ACL rule: ACL SETUSER eve on >pass123 ~* +@write. Why can user 'eve' still run read commands?

A Because the key pattern ~* allows access to all keys, ignoring command categories

B Because +@write does not restrict read commands; it only adds write commands but does not remove read commands

C Because the password >pass123 is invalid and disables the user

D Because the user is off by default and must be explicitly enabled

💡 Hint

ACL rules add permissions but do not remove existing ones unless explicitly revoked.

The +@write category adds write commands but does not remove read commands, so read commands remain allowed unless explicitly revoked.

❓ optimization

expert

Optimizing ACL rules for minimal permissions

You want to create an ACL user that can only run the commands GET and SET on keys starting with 'app:'. Which ACL rule is the most minimal and correct?

A ACL SETUSER minimal on >mypassword ~app:* +GET +SET +@all

B ACL SETUSER minimal on >mypassword ~app:* +@read +@write

C ACL SETUSER minimal on >mypassword ~app:* +@string

D ACL SETUSER minimal on >mypassword ~app:* +GET +SET

💡 Hint

Use explicit command names to limit permissions precisely.

Option D grants only GET and SET commands explicitly, restricting keys to 'app:*', which is minimal and correct.

Practice

1. What is the main purpose of ACL rules in Redis?

easy

A. To control user access to commands and keys

B. To store data persistently on disk

C. To optimize query performance

D. To backup the database automatically

Solution

1. Step 1: Understand ACL rules function

   ACL rules define what commands and keys a user can access in Redis.

2. Step 2: Compare options with ACL purpose

   Only To control user access to commands and keys matches the control of user access, others describe unrelated features.

3. Final Answer:

   To control user access to commands and keys -> Option A

4. Quick Check:

   ACL rules = control access [OK]

Hint: ACL rules control access permissions in Redis [OK]

Common Mistakes:

• Confusing ACL rules with data storage
• Thinking ACL rules optimize performance
• Mixing ACL with backup features

2. Which of the following is the correct syntax to add a user with ACL rules in Redis?

easy

A. ACL SETUSER alice on >password ~* +@all

B. ACL CREATEUSER alice on >password ~* +@all

C. ACL ADDUSER alice on >password ~* +@all

D. ACL NEWUSER alice on >password ~* +@all

Solution

1. Step 1: Recall Redis ACL command for user creation

   The correct command to create or update a user is ACL SETUSER.

2. Step 2: Check each option's command

   Only ACL SETUSER alice on >password ~* +@all uses ACL SETUSER, others use invalid commands.

3. Final Answer:

   ACL SETUSER alice on >password ~* +@all -> Option A

4. Quick Check:

   Use ACL SETUSER to add/update users [OK]

Hint: Use ACL SETUSER to add or update users [OK]

Common Mistakes:

• Using ACL ADDUSER instead of ACL SETUSER
• Using ACL CREATEUSER or ACL NEWUSER which don't exist
• Confusing command names

3. Given the ACL rule ACL SETUSER bob on >mypassword ~cache:* +@read, which commands can user 'bob' execute?

medium

A. Only write commands on any keys

B. All commands including write commands

C. Only read commands on keys starting with 'cache:'

D. No commands because the user is off

Solution

1. Step 1: Analyze the ACL rule components

   User 'bob' is enabled (on), password set, keys limited to pattern 'cache:*', and allowed commands are in category '@read'.

2. Step 2: Determine allowed commands and keys

   Only read commands (+@read) on keys matching 'cache:*' are allowed.

3. Final Answer:

   Only read commands on keys starting with 'cache:' -> Option C

4. Quick Check:

   ACL keys + command categories limit access [OK]

Hint: Check key pattern and command category for user permissions [OK]

Common Mistakes:

• Assuming all commands are allowed
• Ignoring key pattern restrictions
• Thinking user is disabled

4. You run ACL SETUSER alice on >pass123 ~* +@write but Alice cannot execute SET commands. What is the likely issue?

medium

A. The user is not enabled

B. The command category @write does not include SET

C. The key pattern ~* is too restrictive

D. The password is incorrect

Solution

1. Step 1: Verify user status and rules

   User 'alice' is enabled (on), password set, keys unrestricted (~*), commands allowed in @write category.

2. Step 2: Check if SET is in @write category

   SET command belongs to @string category, not @write, so permission is missing.

3. Final Answer:

   The command category @write does not include SET -> Option B

4. Quick Check:

   Command categories must include needed commands [OK]

Hint: Confirm command category includes the command you want [OK]

Common Mistakes:

• Assuming @write includes all write commands
• Thinking key pattern restricts commands
• Ignoring user enabled status

5. You want to create a Redis user 'cacheAdmin' who can run all commands related to caching and keys starting with 'cache:'. Which ACL rule is correct?

hard

A. ACL SETUSER cacheAdmin on >secret ~cache:* +@read +@write

B. ACL SETUSER cacheAdmin on >secret ~cache:* +@all

C. ACL SETUSER cacheAdmin on >secret ~* +@cache

D. ACL SETUSER cacheAdmin on >secret ~cache:* +@cache +@keyspace

Solution

1. Step 1: Identify key pattern restriction

   User must access keys starting with 'cache:', so pattern ~cache:* is needed.

2. Step 2: Select command categories for caching

   Commands related to caching are in @cache and key management in @keyspace categories.

3. Step 3: Evaluate options

   ACL SETUSER cacheAdmin on >secret ~cache:* +@cache +@keyspace correctly combines key pattern and relevant categories; others either allow too much or wrong keys.

4. Final Answer:

   ACL SETUSER cacheAdmin on >secret ~cache:* +@cache +@keyspace -> Option D

5. Quick Check:

   Use key pattern + relevant categories for precise access [OK]

Hint: Combine key patterns with correct categories for precise ACL [OK]

Common Mistakes:

• Using ~* allows all keys, not just cache keys
• Using +@all grants too many permissions
• Missing key pattern restriction