ACL rules and categories in Redis - Step-by-Step Execution

Concept Flow - ACL rules and categories

Start: User connects

↓

Check ACL Categories

↓

Match Command Category?

No→Deny Command

Yes↓

Check Specific ACL Rules

↓

Allow or Deny Command

↓

Execute Command or Return Error

When a user sends a command, Redis checks if the command's category is allowed by ACL categories, then checks specific ACL rules to allow or deny execution.

Execution Sample

Redis

ACL SETUSER alice on >password ~* -@dangerous +@all
AUTH alice password
SET key value

Defines user 'alice' with all commands allowed except dangerous ones, then runs a SET command to see if allowed.

Execution Table

Step	Action	Input/Condition	Result	Notes
1	User 'alice' connects	User 'alice'	User profile loaded	ACL rules for 'alice' active
2	Check command category	Command: SET (category: @write)	Category @write allowed?	Yes, +@all includes @write
3	Check specific ACL rules	Is @dangerous category allowed?	No, -@dangerous denies it	SET is not in @dangerous, so allowed
4	Allow or deny command	All checks passed	Command allowed	SET command executed
5	Execute command	SET key value	Key set in database	Command success response sent

💡 Command allowed because user 'alice' has +@all and -@dangerous, and SET is not dangerous

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
User ACL Categories	none	+@all	+@all and -@dangerous	+@all and -@dangerous	+@all and -@dangerous
Command Category	none	@write	@write	@write	@write
Command Allowed?	unknown	true (category allowed)	true (not denied by specific rules)	true	true

Key Moments - 3 Insights

Why does the command get allowed even though -@dangerous is set?

Because the SET command belongs to the @write category, not @dangerous. The user has +@all which includes @write, so the command is allowed (see execution_table rows 2 and 3).

What happens if a command belongs to a denied category?

If the command's category matches a denied ACL category (like -@dangerous), the command is denied immediately (see execution_table row 3).

How do ACL categories simplify permission management?

ACL categories group commands by type, so you can allow or deny many commands at once instead of listing each command individually (see concept_flow and variable_tracker).

Visual Quiz - 3 Questions

Look at the execution_table, what is the command category checked at step 2?

A @write

B @dangerous

C @read

D @admin

💡 Hint

Check the 'Command Category' column in execution_table row 2

At which step does the system decide if the command is allowed or denied?

A Step 2

B Step 4

C Step 3

D Step 5

💡 Hint

Look at the 'Allow or deny command' action in execution_table

If the user had -@write instead of +@all, what would happen to the SET command?

A Command allowed

B Command category changes

C Command denied

D User disconnected

💡 Hint

Refer to variable_tracker 'User ACL Categories' and execution_table logic for category checks

Concept Snapshot

ACL rules control which commands a user can run.
Categories group commands (e.g., @write, @read).
Users get +category to allow, -category to deny.
Commands checked first by category, then specific rules.
If denied, command is rejected immediately.
Simplifies managing many commands at once.

Full Transcript

When a Redis user connects, the system loads their ACL rules including allowed and denied command categories. When the user sends a command, Redis checks the command's category against the user's allowed categories. If the category is allowed, Redis then checks if any specific deny rules apply. If no denies match, the command is allowed and executed. For example, a user with +@all and -@dangerous can run all commands except those in the dangerous category. The SET command belongs to @write, which is allowed, so it runs successfully. This process helps manage permissions efficiently by grouping commands into categories.

Practice

1. What is the main purpose of ACL rules in Redis?

easy

A. To control user access to commands and keys

B. To store data persistently on disk

C. To optimize query performance

D. To backup the database automatically

Solution

1. Step 1: Understand ACL rules function

   ACL rules define what commands and keys a user can access in Redis.

2. Step 2: Compare options with ACL purpose

   Only To control user access to commands and keys matches the control of user access, others describe unrelated features.

3. Final Answer:

   To control user access to commands and keys -> Option A

4. Quick Check:

   ACL rules = control access [OK]

Hint: ACL rules control access permissions in Redis [OK]

Common Mistakes:

• Confusing ACL rules with data storage
• Thinking ACL rules optimize performance
• Mixing ACL with backup features

2. Which of the following is the correct syntax to add a user with ACL rules in Redis?

easy

A. ACL SETUSER alice on >password ~* +@all

B. ACL CREATEUSER alice on >password ~* +@all

C. ACL ADDUSER alice on >password ~* +@all

D. ACL NEWUSER alice on >password ~* +@all

Solution

1. Step 1: Recall Redis ACL command for user creation

   The correct command to create or update a user is ACL SETUSER.

2. Step 2: Check each option's command

   Only ACL SETUSER alice on >password ~* +@all uses ACL SETUSER, others use invalid commands.

3. Final Answer:

   ACL SETUSER alice on >password ~* +@all -> Option A

4. Quick Check:

   Use ACL SETUSER to add/update users [OK]

Hint: Use ACL SETUSER to add or update users [OK]

Common Mistakes:

• Using ACL ADDUSER instead of ACL SETUSER
• Using ACL CREATEUSER or ACL NEWUSER which don't exist
• Confusing command names

3. Given the ACL rule ACL SETUSER bob on >mypassword ~cache:* +@read, which commands can user 'bob' execute?

medium

A. Only write commands on any keys

B. All commands including write commands

C. Only read commands on keys starting with 'cache:'

D. No commands because the user is off

Solution

1. Step 1: Analyze the ACL rule components

   User 'bob' is enabled (on), password set, keys limited to pattern 'cache:*', and allowed commands are in category '@read'.

2. Step 2: Determine allowed commands and keys

   Only read commands (+@read) on keys matching 'cache:*' are allowed.

3. Final Answer:

   Only read commands on keys starting with 'cache:' -> Option C

4. Quick Check:

   ACL keys + command categories limit access [OK]

Hint: Check key pattern and command category for user permissions [OK]

Common Mistakes:

• Assuming all commands are allowed
• Ignoring key pattern restrictions
• Thinking user is disabled

4. You run ACL SETUSER alice on >pass123 ~* +@write but Alice cannot execute SET commands. What is the likely issue?

medium

A. The user is not enabled

B. The command category @write does not include SET

C. The key pattern ~* is too restrictive

D. The password is incorrect

Solution

1. Step 1: Verify user status and rules

   User 'alice' is enabled (on), password set, keys unrestricted (~*), commands allowed in @write category.

2. Step 2: Check if SET is in @write category

   SET command belongs to @string category, not @write, so permission is missing.

3. Final Answer:

   The command category @write does not include SET -> Option B

4. Quick Check:

   Command categories must include needed commands [OK]

Hint: Confirm command category includes the command you want [OK]

Common Mistakes:

• Assuming @write includes all write commands
• Thinking key pattern restricts commands
• Ignoring user enabled status

5. You want to create a Redis user 'cacheAdmin' who can run all commands related to caching and keys starting with 'cache:'. Which ACL rule is correct?

hard

A. ACL SETUSER cacheAdmin on >secret ~cache:* +@read +@write

B. ACL SETUSER cacheAdmin on >secret ~cache:* +@all

C. ACL SETUSER cacheAdmin on >secret ~* +@cache

D. ACL SETUSER cacheAdmin on >secret ~cache:* +@cache +@keyspace

Solution

1. Step 1: Identify key pattern restriction

   User must access keys starting with 'cache:', so pattern ~cache:* is needed.

2. Step 2: Select command categories for caching

   Commands related to caching are in @cache and key management in @keyspace categories.

3. Step 3: Evaluate options

   ACL SETUSER cacheAdmin on >secret ~cache:* +@cache +@keyspace correctly combines key pattern and relevant categories; others either allow too much or wrong keys.

4. Final Answer:

   ACL SETUSER cacheAdmin on >secret ~cache:* +@cache +@keyspace -> Option D

5. Quick Check:

   Use key pattern + relevant categories for precise access [OK]

Hint: Combine key patterns with correct categories for precise ACL [OK]

Common Mistakes:

• Using ~* allows all keys, not just cache keys
• Using +@all grants too many permissions
• Missing key pattern restriction