Understanding ACL Category Changes in Redis 8

Redis 8 introduces a major update to Access Control Lists (ACLs) by integrating module commands—Search (FT.*), JSON, TimeSeries, and probabilistic data structures (Bloom, Cuckoo, Top-K, CMS, T-Digest) into Redis’ standard ACL categories.
These commands now fall under the familiar groupings such as @read, @write, @fast, @slow, @admin, and @dangerous and each module also has its own new category: @search, @json, @timeseries, @bloom, @cuckoo, @topk, @cms, and @tdigest, for finer-grained control.

The change unifies access control across Redis Cloud, Redis Software, and Redis Open Source, simplifying role management but also altering how existing ACLs behave. Depending on current definitions, some users may gain or lose access to specific commands after upgrading to Redis 8.

This guide explains what changed, who is impacted, how to audit and migrate ACLs safely, and how to validate permissions in both Redis Cloud and Redis Software through the following sections: Breaking Change Summary, Who’s Impacted, Quick Reference, Safe Migration Steps, Post-Upgrade ACL Patterns, Product-Specific Guidance, and Troubleshooting.

Quick Reference: Check and Validate ACLs in Redis 8

Prerequisites

• Redis 8.0 or later (Cloud, Software, or Open Source)

• Admin or Security role with ACL management permissions

• Familiarity with: ACL CAT, ACL LIST, ACL DRYRUN, ACL LOAD

Breaking Change Summary

Who’s Impacted

• Any environment using custom ACLs or roles

• Databases leveraging Search, JSON, TimeSeries, or probabilistic data types

• Deployments defining broad categories (+@read, +@write, +@all) without explicit module controls

Before upgrading to Redis 8, review and adjust ACLs to prevent unexpected access changes.

Safe Migration Steps

1. Inventory existing ACLs

   • Run ACL LIST to export users and rules.

   • Focus on entries containing @read, @write, or module commands (FT.*, JSON.*, TS.*, etc.).

2. Confirm new categories in Redis 8

   ACL CAT

   You should see module categories such as @search and @json.

3. Dry-run permission tests

   ACL DRYRUN <user> <command> [args…]

   Use this to preview grants and denies safely.

4. Choose your strategy

   • Accept expanded coverage: Keep ACLs simpler but broader.

   • Replicate pre-8 intent: Add targeted denies (e.g., -@json, -@search).

5. Validate before production rollout
   Test service accounts and automation users in staging.
    

Optional Tools for Validating ACL Rules

If you prefer a visual way to construct or validate ACL rules across Redis 7.x and 8.x, you can also use the Redis ACL Builder. This tool provides interactive feedback when combining categories such as @read, @write, @json, and @search 
Note: ACL DRYRUN remains the authoritative method for validating permissions in Redis Cloud and Redis Software

Post-Upgrade ACL Patterns

Product-Specific Guidance

Redis Cloud

Redis Cloud 8.0 applies ACL category expansion automatically to all databases.

Before or after upgrading:

1. Export current roles

   • Console: Access Control → Roles → Export

   • REST API: GET /v1/roles

2. Validate permissions

   ACL CAT ACL DRYRUN <user> FT.SEARCH index "*"`

3. Adjust roles

   • Expand capabilities as needed:

     • +@read +@search — adds Search read/write beyond standard @read.

     • +@write +@json — adds JSON read/write beyond standard @write.

     • If you rely on default Redis 8 behavior, @read and @write already include these module commands, so the explicit module category is optional.

   • Restore older limits: +@read +@write -@search -@json

4. Reapply after upgrade
   Re-assign or re-sync roles via the Console or API.

Redis Software

Redis Software 8.0 extends the same ACL expansion to both cluster- and database-level users.

Upgrade Workflow:

1. Backup ACLs

   rladmin export acl

2. Review categories

   ACL CAT

3. Dry-run validation

   ACL DRYRUN <user> JSON.SET key {}

4. Adjust and reload

   • Modify ACLs as needed (+@write -@json, +@read +@search)

   • Propagate changes:

     ACL LOAD

Troubleshooting

References

• Redis 8.0 — What’s New

• Redis Enterprise 8.0 Release Notes

• Redis Cloud 8.0 Release Notes

• ACL Command Reference

Version Scope

• Applies to: Redis 8.0 and later (Open Source, Cloud, Enterprise)

• Prior behavior: Redis ≤ 7.4 kept module commands outside standard categories

• Action required: Review and test ACLs post-upgrade to confirm expected access