Least Privilege for Applications, Operators, Monitoring, Replication, Sentinel, and Cluster

Learning outcomes

This lesson turns Least Privilege for Applications, Operators, Monitoring, Replication, Sentinel, and Cluster into an observable AtlasMart workflow with explicit correctness, failure, and production boundaries.

1. Problem: “service account” is not one role

AtlasMart now has six technical actors: an API, an on-call operator, a monitoring collector, a replica, Sentinel, and Cluster management tooling. Sharing the administrator user among them makes attribution weak and turns every compromised workload into a control-plane compromise. Least privilege begins by describing each actor’s Redis jobs and failure mode before writing ACL syntax.

2. Separate control layers before assigning commands

Redis ACL authentication and command/key/channel authorization operate on client connections. Replication and Sentinel also authenticate when they connect to data nodes. Redis Cluster clients authenticate to each node, while the Cluster bus is a separate internode protocol whose transport should be protected with network isolation/TLS rather than pretending an application ACL user authenticates cluster gossip.

3. Prove the application, monitoring, and operator policies

The common users.acl already defines three distinct human/workload roles. The monitor cannot read AtlasMart keys because no key patterns or data commands are granted. The operator has selected introspection/control-plane reads rather than +@all. Verify exact commands with ACL DRYRUN; treat the output as a contract tied to this Redis version.

A="docker exec -e REDISCLI_AUTH=AtlasMart-Ch22-Admin-Lab-Only-2026 atlasmart-redis-ch22-acl redis-cli --user academy-admin"$A ACL DRYRUN atlasmart-monitor PING$A ACL DRYRUN atlasmart-monitor INFO memory$A ACL DRYRUN atlasmart-monitor GET atlasmart:ch22:catalog:sku42$A ACL DRYRUN atlasmart-operator CONFIG GET maxmemory$A ACL DRYRUN atlasmart-operator CONFIG SET maxmemory 1mb$A ACL DRYRUN atlasmart-operator ACL GETUSER atlasmart-app$A ACL DRYRUN atlasmart-operator ACL SETUSER atlasmart-app off

4. Replication has a documented minimal ACL surface

Redis documents that a replica authenticating to a protected primary needs PSYNC, REPLCONF, and PING; it does not need key access. The Chapter 22 replica-sync user contains exactly those commands. The TLS lab later configures masteruser/masterauth and proves master_link_status:up.

A="docker exec -e REDISCLI_AUTH=AtlasMart-Ch22-Admin-Lab-Only-2026 atlasmart-redis-ch22-acl redis-cli --user academy-admin"$A ACL DRYRUN replica-sync PING$A ACL DRYRUN replica-sync REPLCONF listening-port 6379$A ACL DRYRUN replica-sync PSYNC ? -1$A ACL DRYRUN replica-sync GET atlasmart:ch22:catalog:sku42$A ACL GETUSER replica-sync

5. Sentinel needs control commands, not data keys

Current Redis Sentinel documentation provides a minimal control-user example. Sentinel does not need key access, but it does use a narrow command set and the __sentinel__:hello Pub/Sub channel. Use sentinel auth-user/sentinel auth-pass for data-node authentication. The exact Sentinel command set is operationally privileged; preserve it as its own identity and re-check official docs when upgrading.

user sentinel-control on #168781817c2103868f265a1a0dff3861887620e77da89e4b059dbac0436244ce resetkeys resetchannels &__sentinel__:hello +multi +slaveof +ping +exec +subscribe +config|rewrite +role +publish +info +client|setname +client|kill +script|kill

sentinel monitor atlasmart-primary redis-primary 6379 2sentinel auth-user atlasmart-primary sentinel-controlsentinel auth-pass atlasmart-primary AtlasMart-Ch22-Sentinel-Lab-Only-2026

6. Cluster security has two different planes

An application using Redis Cluster must authenticate to every node it may be redirected to, so compatible ACL users/rules must exist across nodes. A Cluster administrator can receive specific CLUSTER subcommands through a separate operator identity. The Cluster bus itself is not an application ACL session; protect it with private networking and tls-cluster yes when TLS is enabled. Never interpret “six authenticated client ports” as proof that the bus is secured.

7. Credential distribution and topology changes are deployment problems

A secret rotated on only one Redis Cluster node can cause redirection failures. A new replica without the replication credential cannot synchronize. Sentinel credentials must be staged across all monitored data nodes before Sentinel configuration switches. Cluster/Sentinel/replication changes therefore require an order: add new credential → verify every peer/client can use it → switch dependents → remove old credential → force/recycle stale connections as required → verify topology.

8. Deliberately wrong: generic +@admin operator

Command categories are convenient but may be broader than a role needs, and category membership can evolve. The repair is not to avoid categories entirely; it is to start from a role’s tasks, use ACL CAT/COMMAND INFO to inspect the concrete server version, add explicit exceptions, and maintain ACL DRYRUN tests. Treat module commands separately because +@all has especially broad implications.

9. Redis ACLs are not generic RBAC

Redis Open Source ACLs define Redis users and resource/command rules. They do not provide generic application roles, customer hierarchy, approval workflow, or cloud-account RBAC. Managed Redis products may expose their own role systems and may restrict ACL administration differently. Keep those product controls separate from the Redis Open Source lab and verify provider behavior before porting the commands.

10. Evidence checklist before declaring least privilege

For every identity capture ACL GETUSER, positive and negative ACL DRYRUN tests, actual authentication proof, key/channel denial evidence where applicable, and topology health after credential changes. Record which credentials are stored in configs versus injected at runtime. A green permission test is version-specific evidence, not a guarantee that future commands/categories stay identical.

11. Production judgment and bridge

Least privilege reduces blast radius and improves attribution, but too-narrow rules can cause outages during topology changes or new application features. Treat ACL policy as tested code: version it without secrets, review diffs, stage changes, monitor denials, and preserve rollback credentials. Lesson 3 adds TLS so valid identities and permissions cannot be observed or modified in transit.

Summary and next step

Least Privilege for Applications, Operators, Monitoring, Replication, Sentinel, and Cluster is now connected to observable Redis behavior, bounded failure cases, and production tradeoffs. Keep the evidence and cleanup state from this lesson; next, continue with TLS for Client and Internode Traffic, Certificate Lifecycle, and Performance Considerations.

Authoritative references

• Redis security
• Redis ACL tutorial
• ACL SETUSER
• ACL GETUSER
• ACL LIST
• ACL WHOAMI
• ACL CAT
• ACL DRYRUN
• ACL LOG
• ACL SAVE
• ACL LOAD
• AUTH
• Redis TLS
• CLIENT LIST
• CLIENT KILL
• CONFIG GET
• CONFIG SET
• MODULE LOAD
• Redis replication — ACL authentication
• Redis Sentinel — ACL authentication
• Redis Cluster specification
• Redis 8.10 release notes
• Redis 8.10 — what is new
• Redis licenses
• Docker Official Image — Redis