Help Center/ Distributed Cache Service/ User Guide/ Accessing a DCS Redis Instance/ Controlling DCS Redis Access/ Configuring ACL Accounts for DCS Redis Instances
Updated on 2026-08-27 GMT+08:00
View PDF
Share

Configuring ACL Accounts for DCS Redis Instances

If you need to create multiple accounts for a DCS Redis instance, you can use the DCS account management (ACL) capability to create read-only or read/write accounts, implementing granular access control for different users.

Video Tutorial

This video demonstrates how to create an account for a DCS Redis instance. As product functions evolve, the GUI may vary. This tutorial is for reference only.

Notes and Constraints

  • By default, ACL-based account management is supported by DCS Redis 4.0/5.0/6.0/7.0 instances. Currently, it is unavailable for read/write splitting and Proxy Cluster instances of DCS Redis 7.0. This function is temporarily restricted for DCS Redis 6.0/7.0 instances. To enable it, submit a service ticket to contact the customer service. If your DCS Redis 6.0 instance is earlier than v6.2.10.4 or your DCS Redis 7.0 instance is earlier than v7.2.11.3, upgrade the minor version. For details, see Upgrading Minor or Proxy Versions of a DCS Instance.
  • A maximum of 18 accounts can be created for each instance.
  • Currently, only read/write and read-only permissions are supported by account management. Other fine-grained permissions are not supported.

Configuring ACL Accounts for DCS Redis Instances

  1. Log in to the DCS console.
  2. Click in the upper left corner of the console and select the region where your instance is located.
  3. In the navigation pane, choose Cache Manager.
  4. Click the name of a DCS instance to go to its details page.
  5. Choose User Management in the navigation pane.

    On the User Management page, default is the default account of this instance. It has read/write permissions and its password serves as the access password for this instance.

  6. Click Create User to create a regular account.

    If password-free access is enabled for a DCS Redis instance, only the default account can be used, and any created regular accounts do not take effect. To use a regular account, you must first disable password-free access by clicking Reset Password in the Operation column for default.

  7. In the displayed Create User window, enter the username and password.

    • The username can contain 1 to 64 characters. It must start with a letter and can contain only letters, digits, hyphens (-), and underscores (_).
    • The password can contain 8 to 64 characters and cannot be the username or the username spelled backwards. It must contain at least three types of the following characters: lowercase letters, uppercase letters, digits, and special characters `~!@#$%^&*()-_=+\|{},<.>/?

  8. Select Read-only or Read/Write for Permissions.
  9. (Optional) Read-only Routing can be set only for Proxy Cluster or read/write splitting instances.

    To forward read requests of a specified user to the master node, replica node, or both nodes, select Master, Replica, or Master and replica. If you do not need to specify the node to forward read requests, you can disable it.

    Figure 1 Selecting the read-only routing policy
    • This policy is available only when the proxy version of a Proxy Cluster or read/write splitting instance is 5.1.14.19 or later. To upgrade the proxy, see Upgrading Minor or Proxy Versions of a DCS Instance.
    • This policy is currently available with restrictions. If your instance meets the preceding proxy requirements, but Read-only Routing is not displayed on the console, submit a service ticket to contact the customer service.
    • To configure read-only routing for a Proxy Cluster instance, set the backend-master-only parameter to no (to enable read/write splitting). If the parameter is changed to yes after the user is created, the configured policy becomes invalid.
    • This policy can be configured only when both the feature.dcs2.support.acl.read.policy and feature.dcs2.support.acl parameters features are enabled.
    • The read-only routing policy of an ACL account has a lower priority than the support-dispatch-to-replica-list parameter for forwarding read requests. For details, see Read Request Processing Priority.

  10. Enter the description as required. It can contain a maximum of 512 characters.
  11. Click OK.

    Figure 2 User Management

Connecting to an Instance Using an ACL Account

To use a regular ACL account to connect to an instance, set the instance password to {username:password}.

  • To connect to a DCS Redis instance via redis-cli using the default account, run the following command: 
    ./redis-cli -h {dcs_instance_address} -p 6379 -a {password}
  • To connect to a DCS Redis instance using a regular ACL account, run the following command: 
    ./redis-cli -h {dcs_instance_address} -p 6379 -a {username:password}

Follow-up Operations

After a regular account is created, you can perform the operations below.

Table 1 Operations for an account

Operation

Description

Change the password.

Locate the account and click Change Password in the Operation column.

Reset the password.

If no password is set or the password is forgotten, locate the account and click Reset Password in the Operation column.

Change permissions.

Locate the account, click More in the Operation column, and select Manage Permissions. On the page that is displayed, set Permissions to Read-only or Read/Write.

For a Proxy Cluster or read/write splitting instance, you can click More in the Operation column of the default account and select Manage Permissions to set the read-only routing policy. For details, see descriptions on enabling the read-only routing policy. The default account has read/write permissions, which cannot be changed.

Modify the description.

Locate the account, click More in the Operation column, and select Modify Description.

Delete an account.

Locate the account, click More in the Operation column, and select Delete.

The default account cannot be deleted.

Delete accounts in batches.

Select multiple regular accounts to be deleted and click Delete above the account list.

The default account cannot be deleted.

Helpful Links

DCS allows you to create ACL accounts using APIs. For details, see Account Management.

Parent Topic: Controlling DCS Redis Access