ACL rules and categories in Redis - Mini Project: Build & Apply

Redis ACL Rules and Categories

📖 Scenario: You are managing a Redis server that multiple users access. To keep things safe and organized, you want to set up Access Control Lists (ACLs) that control what commands each user can run. This helps protect your data and makes sure users only do what they are allowed to.

🎯 Goal: Build a Redis ACL setup where you create users with specific command categories allowed. You will define users, assign command categories, and verify the ACL rules.

📋 What You'll Learn

Create a Redis user named guest with permission to run only commands in the read category

Create a Redis user named admin with permission to run commands in the allcommands category

Set a password for each user: guestpass for guest and adminpass for admin

Verify the ACL rules by listing users and their allowed categories

💡 Why This Matters

🌍 Real World

In real Redis deployments, ACLs help protect data by limiting what commands users can run. This prevents accidental or malicious changes.

💼 Career

Database administrators and backend developers use Redis ACLs to secure multi-user environments and enforce access policies.

1

Create the guest user with read-only access

Use the Redis ACL command to create a user called guest with the password guestpass and allow only commands in the read category.

Redis

# Your Redis command here to create the guest user with read category and password

Hint

Use ACL SETUSER with on to enable the user, >password to set the password, and +@read to allow read commands.

2

Create the admin user with full access

Use the Redis ACL command to create a user called admin with the password adminpass and allow all commands using the allcommands category.

Redis

ACL SETUSER guest on >guestpass ~* +@read
# Your Redis command here to create the admin user with allcommands category and password

Hint

Remember to use +@allcommands to allow all commands for the admin user.

3

List all users to verify creation

Use the Redis ACL command to list all users and confirm that guest and admin exist.

Redis

ACL SETUSER guest on >guestpass ~* +@read
ACL SETUSER admin on >adminpass ~* +@allcommands
# Your Redis command here to list all ACL users

Hint

Use ACL USERS to see all users.

4

Show the ACL categories allowed for each user

Use the Redis ACL command to get detailed info about the guest and admin users, showing their allowed command categories.

Redis

ACL SETUSER guest on >guestpass ~* +@read
ACL SETUSER admin on >adminpass ~* +@allcommands
ACL USERS
# Your Redis commands here to show ACL details for guest and admin users

Hint

Use ACL GETUSER username to see the rules for each user.

Practice

1. What is the main purpose of ACL rules in Redis?

easy

A. To control user access to commands and keys

B. To store data persistently on disk

C. To optimize query performance

D. To backup the database automatically

Solution

1. Step 1: Understand ACL rules function

   ACL rules define what commands and keys a user can access in Redis.

2. Step 2: Compare options with ACL purpose

   Only To control user access to commands and keys matches the control of user access, others describe unrelated features.

3. Final Answer:

   To control user access to commands and keys -> Option A

4. Quick Check:

   ACL rules = control access [OK]

Hint: ACL rules control access permissions in Redis [OK]

Common Mistakes:

• Confusing ACL rules with data storage
• Thinking ACL rules optimize performance
• Mixing ACL with backup features

2. Which of the following is the correct syntax to add a user with ACL rules in Redis?

easy

A. ACL SETUSER alice on >password ~* +@all

B. ACL CREATEUSER alice on >password ~* +@all

C. ACL ADDUSER alice on >password ~* +@all

D. ACL NEWUSER alice on >password ~* +@all

Solution

1. Step 1: Recall Redis ACL command for user creation

   The correct command to create or update a user is ACL SETUSER.

2. Step 2: Check each option's command

   Only ACL SETUSER alice on >password ~* +@all uses ACL SETUSER, others use invalid commands.

3. Final Answer:

   ACL SETUSER alice on >password ~* +@all -> Option A

4. Quick Check:

   Use ACL SETUSER to add/update users [OK]

Hint: Use ACL SETUSER to add or update users [OK]

Common Mistakes:

• Using ACL ADDUSER instead of ACL SETUSER
• Using ACL CREATEUSER or ACL NEWUSER which don't exist
• Confusing command names

3. Given the ACL rule ACL SETUSER bob on >mypassword ~cache:* +@read, which commands can user 'bob' execute?

medium

A. Only write commands on any keys

B. All commands including write commands

C. Only read commands on keys starting with 'cache:'

D. No commands because the user is off

Solution

1. Step 1: Analyze the ACL rule components

   User 'bob' is enabled (on), password set, keys limited to pattern 'cache:*', and allowed commands are in category '@read'.

2. Step 2: Determine allowed commands and keys

   Only read commands (+@read) on keys matching 'cache:*' are allowed.

3. Final Answer:

   Only read commands on keys starting with 'cache:' -> Option C

4. Quick Check:

   ACL keys + command categories limit access [OK]

Hint: Check key pattern and command category for user permissions [OK]

Common Mistakes:

• Assuming all commands are allowed
• Ignoring key pattern restrictions
• Thinking user is disabled

4. You run ACL SETUSER alice on >pass123 ~* +@write but Alice cannot execute SET commands. What is the likely issue?

medium

A. The user is not enabled

B. The command category @write does not include SET

C. The key pattern ~* is too restrictive

D. The password is incorrect

Solution

1. Step 1: Verify user status and rules

   User 'alice' is enabled (on), password set, keys unrestricted (~*), commands allowed in @write category.

2. Step 2: Check if SET is in @write category

   SET command belongs to @string category, not @write, so permission is missing.

3. Final Answer:

   The command category @write does not include SET -> Option B

4. Quick Check:

   Command categories must include needed commands [OK]

Hint: Confirm command category includes the command you want [OK]

Common Mistakes:

• Assuming @write includes all write commands
• Thinking key pattern restricts commands
• Ignoring user enabled status

5. You want to create a Redis user 'cacheAdmin' who can run all commands related to caching and keys starting with 'cache:'. Which ACL rule is correct?

hard

A. ACL SETUSER cacheAdmin on >secret ~cache:* +@read +@write

B. ACL SETUSER cacheAdmin on >secret ~cache:* +@all

C. ACL SETUSER cacheAdmin on >secret ~* +@cache

D. ACL SETUSER cacheAdmin on >secret ~cache:* +@cache +@keyspace

Solution

1. Step 1: Identify key pattern restriction

   User must access keys starting with 'cache:', so pattern ~cache:* is needed.

2. Step 2: Select command categories for caching

   Commands related to caching are in @cache and key management in @keyspace categories.

3. Step 3: Evaluate options

   ACL SETUSER cacheAdmin on >secret ~cache:* +@cache +@keyspace correctly combines key pattern and relevant categories; others either allow too much or wrong keys.

4. Final Answer:

   ACL SETUSER cacheAdmin on >secret ~cache:* +@cache +@keyspace -> Option D

5. Quick Check:

   Use key pattern + relevant categories for precise access [OK]

Hint: Combine key patterns with correct categories for precise ACL [OK]

Common Mistakes:

• Using ~* allows all keys, not just cache keys
• Using +@all grants too many permissions
• Missing key pattern restriction