Skip to main content

Configure ACL permissions in Aiven for Valkey™

Aiven for Valkey™ uses access control lists (ACLs) to manage the usage of commands and keys based on specific username and password combinations. Direct use of ACL commands is restricted to ensure the reliability of replication, configuration management, and disaster recovery backups for the default user. However, you can create custom ACLs using either the Aiven Console or Aiven CLI.

Aiven for Valkey 9.1 and later supports database-level access control, allowing you to restrict service users to specific logical databases.

Create user and configure ACLs​

To create a user and configure ACLs using the Aiven Console:

  1. Log in to Aiven Console, select your project, and select your Aiven for Valkey service.
  2. Click Users from the left sidebar.
  3. Click Create user, and provide the following details:
    • Username: Enter a username for the user.
    • Categories: Define the command categories accessible to the user. For example, use the prefix +@all or a similar convention to grant users access to all categories. Separate each category entry with a single space.
    • Commands: List the commands the user can execute, separating each command by a single space. For example, input +set -get to grant the user permission to execute the SET command and deny access to the GET command.
    • Channels: Specify the Pub/Sub channels the user can access, separating each with a space.
    • Keys: Define the keys the user can interact with. For example, specify keys like user:123 or product:456, or order:789 to grant the user access to interact with these specific keys in Aiven for Valkey.
    • Databases (Valkey 9.1 and later): Enter database IDs separated by spaces, for example, 0 3. Leave Databases empty or enter alldbs to allow access to all databases. Enter resetdbs to deny access to all databases.
  4. Once you have defined the ACL permissions for the user, click Save.

Restrict access to databases​

Database-level ACLs control which logical databases a service user can access. These restrictions work alongside existing ACL permissions for commands, categories, channels, and keys.

By default, service users can access all databases. Existing users have access to all databases, including after you upgrade to Valkey 9.1 or later.

You can configure database permissions when creating a user or editing ACL rules in the Aiven Console. You can also configure them using the Aiven API.

On Valkey 9.1 and later, the Users page shows a Databases column.

Database access values​

To configure database permissions using the Aiven API, set access_control.valkey_acl_databases to an array of strings. Enter each database ID as a string, for example, "0", not 0. The API accepts the following values:

ValueDescription
[] or omitted when creating a userAllow access to all databases. This is the default.
[] when updating a userRemove the existing restriction and allow access to all databases.
["alldbs"]Allow access to all databases. The API returns the value as you sent it and doesn't change it to [].
["0", "3"]Allow access only to databases 0 and 3.
["resetdbs"]Deny access to all databases.

The following rules apply:

  • Database IDs must be non-negative integers lower than the number of databases configured for the service. Standalone services have 16 databases (0 through 15) by default. Clustered services have one database by default, unless you configure valkey_number_of_databases. The API rejects higher IDs.
  • alldbs and resetdbs must each be the only value in the list. You can't combine either value with database IDs.
  • When updating a user, omit valkey_acl_databases to keep the current database permissions. Send [] to remove the restriction.

Connect as a restricted user​

Users also need the required command and key permissions to perform operations in their allowed databases.

For example, for a user with access to databases 0 and 3:

  • SELECT 3 succeeds if the user has permission to execute the SELECT command.
  • SELECT 1 fails because database 1 isn't allowed.
  • FLUSHALL fails even if the user has permission to execute the command, because it requires access to all databases.
  • With resetdbs, the user can't select any database.

New connections start in database 0, even if the user doesn't have access to it. If a user is restricted to another database, configure the client to select an allowed database when connecting, or use the SELECT command after connecting.

For more information about database permissions and supported commands, see Database permissions in the Valkey documentation.

Limitations​

  • Database restrictions require Valkey 9.1 or later on every node of the service. Requests to set database restrictions fail while any node runs an earlier version, including during an upgrade to 9.1. Sending an empty list ([]) is always accepted.
  • Services already running Valkey 9.1 might need the latest maintenance updates before you can set database restrictions. If saving database restrictions fails with a maintenance error, apply the available maintenance update to your service and try again. For more information, see Service maintenance, updates and upgrades.
  • You can't restrict database access for the default user or Aiven-managed service users. These users always have access to all databases.

User management​

Manage users of your Aiven for Valkey service directly from the Aiven Console.

Reset password​

  1. Click Users from the left sidebar.
  2. Find the user whose password needs to be reset and Click Actions > Reset password.
  3. Confirm the password reset by clicking Reset on the confirmation dialog.

Edit ACL rules​

  1. Click Users from the left sidebar.
  2. Find the user whose ACL rules require editing and Click Actions > Edit ACL rules .
  3. In the Edit access control dialog, update the ACL rules. On Valkey 9.1 and later, you can also update Databases, or clear it to remove the restriction.
  4. Click Save.

Duplicate user​

  1. Click Users from the left sidebar.
  2. Locate the user you wish to duplicate and click Actions > Duplicate user.
  3. Enter a name for the new user in the Duplicate user dialog.
  4. Click Add user.

The new user has the same ACL rules as the original user, including database access.

Delete user​

  1. Click Users from the left sidebar.
  2. Find the user you intend to delete and click Actions > Delete user.
  3. Confirm the deletion by clicking Delete on the confirmation dialog.