Create ACL users, test permissions and make them persistent

Command

# Application user: only app:* keys and channels, dangerous commands excluded:
ACL SETUSER app_rw on >S3cret-Change ~app:* resetchannels &app:* +@read +@write -@dangerous
# Monitoring user: no key access, only specific commands:
ACL SETUSER monitor on >M0n-Secret resetkeys resetchannels -@all +info +ping +client|list +slowlog|get +latency +config|get
# Test permissions without running the command:
ACL DRYRUN app_rw GET app:1001
ACL GETUSER app_rw
ACL LIST
# Make it persistent: ACL SAVE if aclfile is set, otherwise CONFIG REWRITE into redis.conf
ACL SAVE

What it does

Creates application and monitoring users authorized by key prefix, pub/sub channel and command category; tests whether a command is permitted with DRYRUN without running it, and writes the ACLs to disk.

When to use it

When moving from a single shared password (requirepass) to per-user access, isolating applications from each other's keys, or creating a read-only account for a monitoring tool.

Caution

Rule order matters: resetchannels removes any &channel rules given before it. -@dangerous also blocks commands such as KEYS, FLUSHALL, CONFIG and DEBUG; verify the commands the application uses with DRYRUN. If the default user stays enabled with nopass and +@all, ACLs provide no protection; run ACL SETUSER default off after creating an admin user. In redis-cli, if AUTH with --user/--pass fails, the connection continues as the default user and the command still runs; use DRYRUN for permission tests for that reason.