diff --git a/content/operate/rc/security/_index.md b/content/operate/rc/security/_index.md index 3e4a7ab942..033860d681 100644 --- a/content/operate/rc/security/_index.md +++ b/content/operate/rc/security/_index.md @@ -15,10 +15,10 @@ Redis Cloud provides a number of ways to secure subscriptions and databases. As a Redis Cloud user, consider these security domains: - The [Redis Cloud console](#admin-console-security) -- [Your databases]({{< relref "/operate/rc/security/database-security/" >}}) -- The [Redis Cloud API]({{< relref "/operate/rc/api/get-started/enable-the-api" >}}) +- [Your databases](/content/operate/rc/security/database-security/_index.md) +- The [Redis Cloud API](/content/operate/rc/api/get-started/enable-the-api.md) -First, you might want to review our [shared responsibility model]({{< relref "/operate/rc/security/shared-responsibility-model" >}}) for security. +First, you might want to review our [shared responsibility model](/content/operate/rc/security/shared-responsibility-model.md) for security. ## Redis Cloud console security {#admin-console-security} @@ -26,29 +26,28 @@ The Redis Cloud console is the web application you use to manage your Redis Clou Secure access to the Redis Cloud console by: -- Assigning appropriate roles to [team members with access]({{< relref "/operate/rc/security/access-control/access-management#team-management-roles" >}}). +- Assigning appropriate roles to [team members with access](/content/operate/rc/security/access-control/access-management.md#team-management-roles). -- Enabling [multi-factor authentication]({{< relref "/operate/rc/security/access-control/multi-factor-authentication" >}}). +- Enabling [multi-factor authentication](/content/operate/rc/security/access-control/multi-factor-authentication.md). -- Enabling [SAML SSO]({{< relref "/operate/rc/security/access-control/saml-sso" >}}). +- Enabling [SAML SSO](/content/operate/rc/security/access-control/saml-sso/_index.md). -{{< note >}} -A user session on Redis Cloud expires after 30 minutes. You'll be signed out of Redis Cloud after 30 minutes of inactivity. -{{< /note >}} +> [!NOTE] +> A user session on Redis Cloud expires after 30 minutes. You'll be signed out of Redis Cloud after 30 minutes of inactivity. ## Database security -You have several options when it comes to securing your Redis Cloud databases. For more information, see [Cloud database security]({{< relref "/operate/rc/security/database-security/" >}}). Options include: +You have several options when it comes to securing your Redis Cloud databases. For more information, see [Cloud database security](/content/operate/rc/security/database-security/_index.md). Options include: -- [Encryption at rest]({{< relref "/operate/rc/security/encryption-at-rest" >}}) -- [Role-based access control]({{< relref "/operate/rc/security/access-control/data-access-control/role-based-access-control" >}}) -- [TLS]({{< relref "/operate/rc/security/database-security/tls-ssl" >}}) -- [Network security]({{< relref "/operate/rc/security/database-security/network-security" >}}) using -- [VPC peering]({{< relref "/operate/rc/security/vpc-peering" >}}) and [CIDR whitelist]({{< relref "/operate/rc/security/cidr-whitelist" >}}) +- [Encryption at rest](/content/operate/rc/security/encryption-at-rest.md) +- [Role-based access control](/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md) +- [TLS](/content/operate/rc/security/database-security/tls-ssl.md) +- [Network security](/content/operate/rc/security/database-security/network-security.md) using +- [VPC peering](/content/operate/rc/security/vpc-peering.md) and [CIDR whitelist](/content/operate/rc/security/cidr-whitelist.md) ## API security -The Redis Cloud API allows you to programmatically administer your subscriptions and database deployments. This API is disabled by default. When you [enable the API]({{< relref "/operate/rc/api/get-started/enable-the-api" >}}), you can then [manage the API keys]({{< relref "/operate/rc/api/get-started/manage-api-keys" >}}) for all owners of your Redis Cloud account. For an overview of the security features of the API, see the [API authentication documentation]({{< relref "/operate/rc/api/get-started/" >}}). +The Redis Cloud API allows you to programmatically administer your subscriptions and database deployments. This API is disabled by default. When you [enable the API](/content/operate/rc/api/get-started/enable-the-api.md), you can then [manage the API keys](/content/operate/rc/api/get-started/manage-api-keys.md) for all owners of your Redis Cloud account. For an overview of the security features of the API, see the [API authentication documentation](/content/operate/rc/api/get-started/_index.md). ## Continue learning with Redis University diff --git a/content/operate/rc/security/access-control/access-management.md b/content/operate/rc/security/access-control/access-management.md index 52f12d0a0c..e7ca35877d 100644 --- a/content/operate/rc/security/access-control/access-management.md +++ b/content/operate/rc/security/access-control/access-management.md @@ -14,11 +14,11 @@ The **Access management** screen helps you manage: - The team of users allowed to access your subscription and its databases. - The API keys that authenticate application access to your account. -- [Single sign-on (SSO) with SAML]({{< relref "/operate/rc/security/access-control/saml-sso" >}}). +- [Single sign-on (SSO) with SAML](/content/operate/rc/security/access-control/saml-sso/_index.md). Here, you learn how to manage your team's users and control their level of access. -For help managing API keys, see [Manage API keys]({{< relref "/operate/rc/api/get-started/manage-api-keys" >}}). +For help managing API keys, see [Manage API keys](/content/operate/rc/api/get-started/manage-api-keys.md). ## Manage team access @@ -54,7 +54,7 @@ Use the dialog to specify these values. | **Role** | The role identifies their subscription and account privileges. For details, see [Team management roles](#team-management-roles). | | **Email** | The address used for alerts and other email messages regarding the account | | **Alert emails** | Enable to be notified when subscription databases cross certain thresholds, such as exceeding memory limits or latency requirements | -| **Operational emails** | Notifications about subscription and database changes, such as creating or deleting a database, and [subscription and database maintenance]({{< relref "/operate/rc/subscriptions/maintenance" >}}) | +| **Operational emails** | Notifications about subscription and database changes, such as creating or deleting a database, and [subscription and database maintenance](/content/operate/rc/subscriptions/maintenance/_index.md) | | **Billing emails** | Notifications about billing, such as when bills are issued and paid | | **Multi-factor authentication** | Whether MFA is enabled for the member. This is deactivated when members have not enabled or confirmed MFA in their user profile settings. | @@ -107,7 +107,7 @@ Roles and responsibilities are: - **Viewer** can view all databases and their configurations, including database secrets. -- **Logs viewer** can not access the Redis Cloud console. They are only allowed access to the [Redis Cloud API]({{< relref "/operate/rc/api" >}}) [`GET logs/`]({{< relref "/operate/rc/api/api-reference#tag/Account/operation/getAccountSystemLogs" >}}) endpoint. +- **Logs viewer** can not access the Redis Cloud console. They are only allowed access to the [Redis Cloud API](/content/operate/rc/api/_index.md) [`GET logs/`](/content/operate/rc/api/api-reference.md#tag/Account/operation/getAccountSystemLogs) endpoint. This table shows each role's ability to perform common tasks. @@ -124,7 +124,7 @@ This table shows each role's ability to perform common tasks. | Edit database (no cost impact) | ✅ Yes | ❌ No | ✅ Yes | ✅ Yes | ❌ No | ❌ No | | View subscription | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ❌ No | | View database | ✅ Yes | ✅ Yes[4](#table-note-4) | ✅ Yes | ✅ Yes | ✅ Yes | ❌ No | -| Use the [REST API]({{< relref "/operate/rc/api" >}}) | ✅ Yes | ✅ Yes[5](#table-note-5) | ❌ No | ❌ No | ✅ Yes[6](#table-note-6) | ✅ Yes[7](#table-note-7) | +| Use the [REST API](/content/operate/rc/api/_index.md) | ✅ Yes | ✅ Yes[5](#table-note-5) | ❌ No | ❌ No | ✅ Yes[6](#table-note-6) | ✅ Yes[7](#table-note-7) | 1. Billing Admins can only edit the account billing address in Account Settings. @@ -138,4 +138,4 @@ This table shows each role's ability to perform common tasks. 6. Viewers can use the REST API for GET requests, but cannot modify subscription or database details. -7. Logs viewers can only use the [`GET logs/`]({{< relref "/operate/rc/api/api-reference#tag/Account/operation/getAccountSystemLogs" >}}) endpoint of the REST API. +7. Logs viewers can only use the [`GET logs/`](/content/operate/rc/api/api-reference.md#tag/Account/operation/getAccountSystemLogs) endpoint of the REST API. diff --git a/content/operate/rc/security/access-control/data-access-control/_index.md b/content/operate/rc/security/access-control/data-access-control/_index.md index 523dc35efa..b0a8bbf8bd 100644 --- a/content/operate/rc/security/access-control/data-access-control/_index.md +++ b/content/operate/rc/security/access-control/data-access-control/_index.md @@ -16,14 +16,14 @@ weight: 25 ## Default user -When you create a Redis Cloud database, your database is given a randomly generated password called the [**Default user password**]({{< relref "/operate/rc/security/access-control/data-access-control/default-user" >}}). Learn how to [change the default user password]({{< relref "/operate/rc/security/access-control/data-access-control/default-user#change-password" >}}) or [turn off default user access]({{< relref "/operate/rc/security/access-control/data-access-control/default-user#turn-off-default-user" >}}). +When you create a Redis Cloud database, your database is given a randomly generated password called the [**Default user password**](/content/operate/rc/security/access-control/data-access-control/default-user.md). Learn how to [change the default user password](/content/operate/rc/security/access-control/data-access-control/default-user.md#change-password) or [turn off default user access](/content/operate/rc/security/access-control/data-access-control/default-user.md#turn-off-default-user). ## Role-based access control -With [role-based access control (RBAC)]({{< relref "/operate/rc/security/access-control/data-access-control/role-based-access-control.md" >}}), you create roles and assign users to those roles to grant different levels of access to the database. +With [role-based access control (RBAC)](/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md), you create roles and assign users to those roles to grant different levels of access to the database. -- [Enable RBAC]({{< relref "/operate/rc/security/access-control/data-access-control/role-based-access-control" >}}) -- [Configure ACLs]({{< relref "/operate/rc/security/access-control/data-access-control/configure-acls" >}}) -- [Create roles]({{< relref "/operate/rc/security/access-control/data-access-control/create-roles" >}}) -- [Create and edit database users]({{< relref "/operate/rc/security/access-control/data-access-control/create-assign-users" >}}) -- [Active-Active roles]({{< relref "/operate/rc/security/access-control/data-access-control/active-active-roles" >}}) \ No newline at end of file +- [Enable RBAC](/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md) +- [Configure ACLs](/content/operate/rc/security/access-control/data-access-control/configure-acls.md) +- [Create roles](/content/operate/rc/security/access-control/data-access-control/create-roles.md) +- [Create and edit database users](/content/operate/rc/security/access-control/data-access-control/create-assign-users.md) +- [Active-Active roles](/content/operate/rc/security/access-control/data-access-control/active-active-roles.md) \ No newline at end of file diff --git a/content/operate/rc/security/access-control/data-access-control/active-active-roles.md b/content/operate/rc/security/access-control/data-access-control/active-active-roles.md index 238feb004f..bbfc2152fc 100644 --- a/content/operate/rc/security/access-control/data-access-control/active-active-roles.md +++ b/content/operate/rc/security/access-control/data-access-control/active-active-roles.md @@ -12,7 +12,7 @@ toc: 'true' weight: $weight --- -For [Active-Active databases]({{< relref "/operate/rc/databases/active-active" >}}), you can define roles with different levels of access for different regions. For example, you can define a user role with full database access in one region and read-only access in another. Or, you can prevent a user from running any commands in a specified region. +For [Active-Active databases](/content/operate/rc/databases/active-active/_index.md), you can define roles with different levels of access for different regions. For example, you can define a user role with full database access in one region and read-only access in another. Or, you can prevent a user from running any commands in a specified region. 1. Go to **Data Access Control > Roles** and either select `+` to create a new role or point to an existing role and select the pencil icon to edit it. @@ -26,9 +26,9 @@ For [Active-Active databases]({{< relref "/operate/rc/databases/active-active" > 1. To set the role's default level of access to the selected databases, choose a **Redis ACL** from the list and select the check mark to confirm the association. - {{< note >}} -The default level of access to the selected database only applies to regions that exist when the role is created. If you add a new region to your Active-Active subscription, the new region will default to **No Access** for the role. - {{< /note >}} + > [!NOTE] + > The default level of access to the selected database only applies to regions that exist when the role is created. If you add a new region to your Active-Active subscription, the new region will default to **No Access** for the role. + > 1. Select the ACL name next to a region to change which ACL applies to that region. @@ -38,10 +38,9 @@ The default level of access to the selected database only applies to regions tha 1. Select **Save role**. -When you assign a user-defined ACL rule to a role and associate it with one or more databases, Redis will verify that the ACL rule will work with the selected databases. Verify that the [syntax]({{< relref "/operate/rc/security/access-control/data-access-control/configure-acls#define-permissions-with-acl-syntax" >}}) of the ACL rule is correct if you receive an error. +When you assign a user-defined ACL rule to a role and associate it with one or more databases, Redis will verify that the ACL rule will work with the selected databases. Verify that the [syntax](/content/operate/rc/security/access-control/data-access-control/configure-acls.md#define-permissions-with-acl-syntax) of the ACL rule is correct if you receive an error. -After you create a role, you can assign it to a user. Users with this role can access the databases according to the role's associated Redis ACLs. For more information, see [Assign roles to users]({{< relref "/operate/rc/security/access-control/data-access-control/create-assign-users#assign-roles-to-existing-users" >}}). +After you create a role, you can assign it to a user. Users with this role can access the databases according to the role's associated Redis ACLs. For more information, see [Assign roles to users](/content/operate/rc/security/access-control/data-access-control/create-assign-users.md#assign-roles-to-existing-users). -{{< note >}} -{{< embed-md "rc-acls-note.md" >}} -{{< /note >}} \ No newline at end of file +> [!NOTE] +> {{< embed-md "rc-acls-note.md" >}} \ No newline at end of file diff --git a/content/operate/rc/security/access-control/data-access-control/configure-acls.md b/content/operate/rc/security/access-control/data-access-control/configure-acls.md index 7ec6e37bfc..8ceade2ce9 100644 --- a/content/operate/rc/security/access-control/data-access-control/configure-acls.md +++ b/content/operate/rc/security/access-control/data-access-control/configure-acls.md @@ -36,7 +36,8 @@ To configure a Redis ACL that you can assign to a data access role: {{Add or Update Redis ACL.}} - {{< note >}}The built-in Redis ACLs can't be edited.{{< /note >}} + > [!NOTE] + > The built-in Redis ACLs can't be edited. 1. Provide a descriptive name and create the ACL rule [using ACL syntax](#define-permissions-with-acl-syntax). @@ -46,23 +47,23 @@ To configure a Redis ACL that you can assign to a data access role: {{Saved Redis ACL.}} -After you create a Redis ACL, you can assign it to a role. Redis ACLs are not fully verified until they are assigned to a role. For more information, see [Create roles]({{< relref "/operate/rc/security/access-control/data-access-control/create-roles" >}}) or [Active-Active access roles]({{< relref "/operate/rc/security/access-control/data-access-control/active-active-roles" >}}) for an [Active-Active database]({{< relref "/operate/rc/databases/active-active" >}}). +After you create a Redis ACL, you can assign it to a role. Redis ACLs are not fully verified until they are assigned to a role. For more information, see [Create roles](/content/operate/rc/security/access-control/data-access-control/create-roles.md) or [Active-Active access roles](/content/operate/rc/security/access-control/data-access-control/active-active-roles.md) for an [Active-Active database](/content/operate/rc/databases/active-active/_index.md). ## Define permissions with ACL syntax -You can define these permissions using the [Redis ACL syntax]({{< relref "/operate/oss_and_stack/management/security/acl" >}}#acl-rules). This syntax lets you concisely specify which commands, command categories, keys, and pub/sub channels to allow. +You can define these permissions using the [Redis ACL syntax](/content/operate/oss_and_stack/management/security/acl.md#acl-rules). This syntax lets you concisely specify which commands, command categories, keys, and pub/sub channels to allow. - `+` *includes* commands or command categories - `-` *excludes* commands or command categories - `@` indicates a command category - `~` defines a permitted key pattern -- `&` allows access to a [pub/sub channel]({{< relref "/develop/pubsub" >}}) +- `&` allows access to a [pub/sub channel](/content/develop/pubsub/_index.md) The Redis Cloud console will validate your ACL syntax while you are typing. ### Command ACL rules -A **command** can be any [Redis command]({{< relref "/commands" >}}). +A **command** can be any [Redis command](/content/commands). For example, this Redis ACL rule indicates that the `SET` command is permitted: @@ -72,7 +73,7 @@ For example, this Redis ACL rule indicates that the `SET` command is permitted: ### Command category ACL rules -A [**command category**]({{< relref "/operate/oss_and_stack/management/security/acl" >}}#command-categories) is a predefined, named set of commands. +A [**command category**](/content/operate/oss_and_stack/management/security/acl.md#command-categories) is a predefined, named set of commands. For example, the Redis commands that read data are available in the `read` command category. This Redis ACL rule permits access to all read commands: @@ -82,7 +83,7 @@ read data are available in the `read` command category. This Redis ACL rule perm ``` To find out which commands are included in the -`read` command category, run the following command with [`redis-cli`]({{< relref "/operate/rs/references/cli-utilities/redis-cli" >}}): +`read` command category, run the following command with [`redis-cli`](/content/operate/rs/references/cli-utilities/redis-cli/_index.md): ```sh ACL CAT read @@ -90,7 +91,7 @@ ACL CAT read ### Key ACL rules -To specify which **keys** are accessible, use the [key permissions syntax]({{< relref "/operate/oss_and_stack/management/security/acl" >}}#key-permissions). +To specify which **keys** are accessible, use the [key permissions syntax](/content/operate/oss_and_stack/management/security/acl.md#key-permissions). The following ACL rule allows access to all keys: @@ -112,11 +113,11 @@ The following ACL rule allows you to copy information from keys prefixed with `c +@all ~app:* %R~cache:* ``` -For more information on how this works, see the [key permissions syntax]({{< relref "/operate/oss_and_stack/management/security/acl" >}}#key-permissions). +For more information on how this works, see the [key permissions syntax](/content/operate/oss_and_stack/management/security/acl.md#key-permissions). ### Pub/sub ACL rules -Pub/sub ACL rules determine which pub/sub channels a user can access. For more information see, [Redis pub/sub]({{< relref "/develop/pubsub" >}}) +Pub/sub ACL rules determine which pub/sub channels a user can access. For more information see, [Redis pub/sub](/content/develop/pubsub/_index.md) For versions older than Redis 7.0, pub/sub is permissive and allows access to all channels by default. @@ -152,7 +153,7 @@ allchannels ### Selectors -Starting with Redis 7.0, Redis supports adding multiple sets of rules that are evaluated independently of each other, called [selectors]({{< relref "/operate/oss_and_stack/management/security/acl" >}}#selectors). +Starting with Redis 7.0, Redis supports adding multiple sets of rules that are evaluated independently of each other, called [selectors](/content/operate/oss_and_stack/management/security/acl.md#selectors). The following ACL rule allows a user to execute `GET` on keys prefixed with `cache` and `SET` on keys prefixed with `app`: diff --git a/content/operate/rc/security/access-control/data-access-control/create-assign-users.md b/content/operate/rc/security/access-control/data-access-control/create-assign-users.md index 1c881fccd0..d042410ebd 100644 --- a/content/operate/rc/security/access-control/data-access-control/create-assign-users.md +++ b/content/operate/rc/security/access-control/data-access-control/create-assign-users.md @@ -12,7 +12,7 @@ toc: 'true' weight: 25 --- -Before you create a database user, you must [create a data access role]({{< relref "/operate/rc/security/access-control/data-access-control/create-roles" >}}) to assign to that user. +Before you create a database user, you must [create a data access role](/content/operate/rc/security/access-control/data-access-control/create-roles.md) to assign to that user. ## Create a user @@ -34,11 +34,11 @@ To create a user: {{User add username.}} - {{}} -An error occurs if a user tries to connect to a memcached database with the username `admin`. Do not use `admin` for a username if the user will be connecting to a memcached database. - {{}} + > [!NOTE] + > An error occurs if a user tries to connect to a memcached database with the username `admin`. Do not use `admin` for a username if the user will be connecting to a memcached database. + > -1. Select a [**Role**]({{< relref "/operate/rc/security/access-control/data-access-control/create-roles" >}}) from the list. +1. Select a [**Role**](/content/operate/rc/security/access-control/data-access-control/create-roles.md) from the list. {{User select role.}} @@ -65,7 +65,7 @@ To assign a data access role to an existing user: {{User add or edit.}} -1. Select a [**Role**]({{< relref "/operate/rc/security/access-control/data-access-control/create-roles" >}}) from the list. +1. Select a [**Role**](/content/operate/rc/security/access-control/data-access-control/create-roles.md) from the list. {{User select role.}} diff --git a/content/operate/rc/security/access-control/data-access-control/create-roles.md b/content/operate/rc/security/access-control/data-access-control/create-roles.md index bc839c643e..e6ef43c089 100644 --- a/content/operate/rc/security/access-control/data-access-control/create-roles.md +++ b/content/operate/rc/security/access-control/data-access-control/create-roles.md @@ -12,7 +12,7 @@ toc: 'true' weight: 20 --- -To assign [Redis ACLs]({{< relref "/operate/rc/security/access-control/data-access-control/configure-acls" >}}) to a data access role: +To assign [Redis ACLs](/content/operate/rc/security/access-control/data-access-control/configure-acls.md) to a data access role: 1. Go to **Data Access Control** from the [Redis Cloud console](https://cloud.redis.io/#/) menu. @@ -42,10 +42,9 @@ To assign [Redis ACLs]({{< relref "/operate/rc/security/access-control/data-acce When you assign a user-defined ACL rule to a role and associate it with one or more databases, we'll verify that the ACL rule will work with the selected databases. The database may go into an Inactive state for a few seconds while we verify the ACL rule. -After you create a role, you can assign it to a user. Users with this role can access the databases according to the role's associated Redis ACLs. For more information, see [Assign roles to users]({{< relref "/operate/rc/security/access-control/data-access-control/create-assign-users#assign-roles-to-existing-users" >}}). +After you create a role, you can assign it to a user. Users with this role can access the databases according to the role's associated Redis ACLs. For more information, see [Assign roles to users](/content/operate/rc/security/access-control/data-access-control/create-assign-users.md#assign-roles-to-existing-users). -To assign Redis ACLs to a role for an [Active-Active database]({{< relref "/operate/rc/databases/active-active" >}}), see [Active-Active access roles]({{< relref "/operate/rc/security/access-control/data-access-control/active-active-roles" >}}). +To assign Redis ACLs to a role for an [Active-Active database](/content/operate/rc/databases/active-active/_index.md), see [Active-Active access roles](/content/operate/rc/security/access-control/data-access-control/active-active-roles.md). -{{< note >}} -{{< embed-md "rc-acls-note.md" >}} -{{< /note >}} \ No newline at end of file +> [!NOTE] +> {{< embed-md "rc-acls-note.md" >}} \ No newline at end of file diff --git a/content/operate/rc/security/access-control/data-access-control/default-user.md b/content/operate/rc/security/access-control/data-access-control/default-user.md index 9bf32fa1da..8d13f4b7a4 100644 --- a/content/operate/rc/security/access-control/data-access-control/default-user.md +++ b/content/operate/rc/security/access-control/data-access-control/default-user.md @@ -19,11 +19,11 @@ Use the copy button to copy the password to the clipboard: {{Use the Copy button to copy the default user password.}} -You'll need to use this password whenever you connect to your database using a Redis client. See [Connect to a database]({{< relref "/operate/rc/databases/connect" >}}) for more info. +You'll need to use this password whenever you connect to your database using a Redis client. See [Connect to a database](/content/operate/rc/databases/connect/_index.md) for more info. -If you have [blocked the public endpoint]({{< relref "/operate/rc/security/database-security/block-public-endpoints" >}}) for your Redis Cloud Pro subscription, you can also turn on passwordless authentication for the default user. See [Block public endpoints]({{< relref "/operate/rc/security/database-security/block-public-endpoints#turn-on-passwordless-authentication-for-the-default-user" >}}) for more info. +If you have [blocked the public endpoint](/content/operate/rc/security/database-security/block-public-endpoints.md) for your Redis Cloud Pro subscription, you can also turn on passwordless authentication for the default user. See [Block public endpoints](/content/operate/rc/security/database-security/block-public-endpoints.md#turn-on-passwordless-authentication-for-the-default-user) for more info. -See your [Redis client's documentation]({{< relref "/develop/clients" >}}) to learn how to provide your password when connecting. +See your [Redis client's documentation](/content/develop/clients/_index.md) to learn how to provide your password when connecting. ## Change password @@ -55,7 +55,7 @@ How you change the default user password depends on your plan. ## Turn off default user -After you set up [role-based access control]({{< relref "/operate/rc/security/access-control/data-access-control/role-based-access-control" >}}) to limit who can access your database, we recommend that you turn off default user access. +After you set up [role-based access control](/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md) to limit who can access your database, we recommend that you turn off default user access. How you turn off the default user depends on your plan. diff --git a/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md b/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md index 35ae9e0d59..972f01a741 100644 --- a/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md +++ b/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md @@ -25,19 +25,20 @@ To set up RBAC, first navigate to the **Data Access Control** screen. There are three tabs on this screen: **Users**, **Roles**, and **Redis ACLs**. -In the **Redis ACLs** tab, you [define named *permissions*]({{< relref "/operate/rc/security/access-control/data-access-control/configure-acls" >}}) for specific Redis commands, keys, and pub/sub channels. +In the **Redis ACLs** tab, you [define named *permissions*](/content/operate/rc/security/access-control/data-access-control/configure-acls.md) for specific Redis commands, keys, and pub/sub channels. {{Data access control screen.}} -In the **Roles** tab, you [create roles]({{< relref "/operate/rc/security/access-control/data-access-control/create-roles" >}}). Each role consists of a set of permissions for one or more Redis Cloud databases. +In the **Roles** tab, you [create roles](/content/operate/rc/security/access-control/data-access-control/create-roles.md). Each role consists of a set of permissions for one or more Redis Cloud databases. {{Data access control screen.}} -Finally, in the **Users** tab, you [create users]({{< relref "/operate/rc/security/access-control/data-access-control/create-assign-users" >}}) and [assign each user a role]({{< relref "/operate/rc/security/access-control/data-access-control/create-assign-users#assign-roles-to-existing-users" >}}). +Finally, in the **Users** tab, you [create users](/content/operate/rc/security/access-control/data-access-control/create-assign-users.md) and [assign each user a role](/content/operate/rc/security/access-control/data-access-control/create-assign-users.md#assign-roles-to-existing-users). {{Data access control screen.}} -{{}}Database access users are different from account access users. To learn more, see [Access management]({{< relref "/operate/rc/security/access-control/" >}}).{{}} +> [!NOTE] +> Database access users are different from account access users. To learn more, see [Access management](/content/operate/rc/security/access-control/_index.md). ## Redis ACLs vs. Redis Cloud RBAC diff --git a/content/operate/rc/security/access-control/multi-factor-authentication.md b/content/operate/rc/security/access-control/multi-factor-authentication.md index 78d19e9b27..7f3ba8abfd 100644 --- a/content/operate/rc/security/access-control/multi-factor-authentication.md +++ b/content/operate/rc/security/access-control/multi-factor-authentication.md @@ -17,9 +17,8 @@ When MFA is enabled, users must enter their username, password, and an authentic To further increase the security of the account, the account owner can [require MFA enforcement for all users](#enforcing). -{{< note >}} -Once you enable MFA, it will be required to access every account that belongs to you. Deactivating MFA enforcement on an account does not deactivate MFA enforcement for other users of that account that have defined a phone number. To deactivate MFA enforcement for other users, those users will each need to deactivate MFA enforcement for their own user accounts. -{{< /note >}} +> [!NOTE] +> Once you enable MFA, it will be required to access every account that belongs to you. Deactivating MFA enforcement on an account does not deactivate MFA enforcement for other users of that account that have defined a phone number. To deactivate MFA enforcement for other users, those users will each need to deactivate MFA enforcement for their own user accounts. ### Enable MFA @@ -42,9 +41,8 @@ To configure MFA for your user account: Your account is now configured for MFA. -{{< note >}} -We recommend that you also [configure MFA for an authenticator app](#app) as an additional factor. -{{< /note >}} +> [!NOTE] +> We recommend that you also [configure MFA for an authenticator app](#app) as an additional factor. If you cannot sign in to your account because of MFA, please [contact support](https://redis.io/support/). @@ -86,9 +84,8 @@ You can deactivate MFA for your user account. To deactivate MFA, go to your prof Account owner users can enable MFA enforcement for all users in their account. After MFA is enforced for the account, all users who do not have MFA enabled will be required to configure MFA the next time they sign in to the Redis Cloud console. -{{< note >}} -Redis Cloud does not enforce MFA for [SAML SSO]({{< relref "/operate/rc/security/access-control/saml-sso" >}}) users since the identity provider handles MFA management and enforcement. -{{< /note >}} +> [!NOTE] +> Redis Cloud does not enforce MFA for [SAML SSO](/content/operate/rc/security/access-control/saml-sso/_index.md) users since the identity provider handles MFA management and enforcement. To enable MFA enforcement for all user accounts: @@ -103,6 +100,5 @@ To enable MFA enforcement for all user accounts: 4. Select **Save changes** to save your changes. -{{< tip >}} -Notify all of your Redis Cloud console users before enabling MFA enforcement. -{{< /tip >}} +> [!TIP] +> Notify all of your Redis Cloud console users before enabling MFA enforcement. diff --git a/content/operate/rc/security/access-control/saml-sso/_index.md b/content/operate/rc/security/access-control/saml-sso/_index.md index 2323d1ade4..ca0b2df8b7 100644 --- a/content/operate/rc/security/access-control/saml-sso/_index.md +++ b/content/operate/rc/security/access-control/saml-sso/_index.md @@ -24,15 +24,15 @@ When SAML SSO is enabled, the [identity provider (IdP)](https://en.wikipedia.org You can use any identity provider to integrate with Redis Cloud as long as it supports the SAML protocol. You can also refer to these integration guides for several popular identity providers: - - [Auth0 SAML integration]({{< relref "/operate/rc/security/access-control/saml-sso/saml-integration-auth0" >}}) - - [AWS IAM Identity Center SAML integration]({{< relref "/operate/rc/security/access-control/saml-sso/saml-integration-aws-identity-center" >}}) - - [Azure Active Directory SAML integration]({{< relref "/operate/rc/security/access-control/saml-sso/saml-integration-azure-ad" >}}) - - [Google Workspace integration]({{< relref "/operate/rc/security/access-control/saml-sso/saml-integration-google" >}}) - - [Okta SAML integration (Generic)]({{< relref "/operate/rc/security/access-control/saml-sso/saml-integration-okta-generic" >}}) - - [Okta SAML integration (Org2Org)]({{< relref "/operate/rc/security/access-control/saml-sso/saml-integration-okta-org2org" >}}) - - [PingIdentity SAML integration]({{< relref "/operate/rc/security/access-control/saml-sso/saml-integration-ping-identity" >}}) + - [Auth0 SAML integration](/content/operate/rc/security/access-control/saml-sso/saml-integration-auth0.md) + - [AWS IAM Identity Center SAML integration](/content/operate/rc/security/access-control/saml-sso/saml-integration-aws-identity-center.md) + - [Azure Active Directory SAML integration](/content/operate/rc/security/access-control/saml-sso/saml-integration-azure-ad.md) + - [Google Workspace integration](/content/operate/rc/security/access-control/saml-sso/saml-integration-google.md) + - [Okta SAML integration (Generic)](/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-generic.md) + - [Okta SAML integration (Org2Org)](/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-org2org.md) + - [PingIdentity SAML integration](/content/operate/rc/security/access-control/saml-sso/saml-integration-ping-identity.md) -After you activate SAML SSO for a Redis Cloud account, all existing local users for the account, except for the user that set up SAML SSO, are converted to SAML users and are required to use SAML SSO to sign in. Before they can sign in to Redis Cloud, the identity provider admin needs to set up these users on the IdP side and configure the `redisAccountMapping` attribute to map them to the appropriate Redis Cloud accounts and [roles]({{< relref "/operate/rc/security/access-control/access-management#team-management-roles" >}}). +After you activate SAML SSO for a Redis Cloud account, all existing local users for the account, except for the user that set up SAML SSO, are converted to SAML users and are required to use SAML SSO to sign in. Before they can sign in to Redis Cloud, the identity provider admin needs to set up these users on the IdP side and configure the `redisAccountMapping` attribute to map them to the appropriate Redis Cloud accounts and [roles](/content/operate/rc/security/access-control/access-management.md#team-management-roles). ### IdP-initiated SSO @@ -56,7 +56,7 @@ You can also initiate single sign-on from the [Redis Cloud console](https://clou ### Multi-factor authentication -The account owner remains a local user and should set up [multi-factor authentication (MFA)]({{< relref "/operate/rc/security/access-control/multi-factor-authentication" >}}) to help secure their account. After SAML activation, the account owner can set up additional local bypass users with MFA enabled. +The account owner remains a local user and should set up [multi-factor authentication (MFA)](/content/operate/rc/security/access-control/multi-factor-authentication.md) to help secure their account. After SAML activation, the account owner can set up additional local bypass users with MFA enabled. If MFA enforcement is enabled, note that Redis Cloud does not enforce MFA for SAML users since the identity provider handles MFA management and enforcement. @@ -137,7 +137,7 @@ Set up a SAML app to integrate Redis Cloud with your identity provider: | FirstName | User's first name | | LastName | User's last name | | Email | User's email address (used as the username in the Redis Cloud console) | - | redisAccountMapping | Key-value pair of a lowercase [role name]({{< relref "/operate/rc/security/access-control/access-management#team-management-roles" >}}) (owner, member, manager, billing_admin, or viewer) and the user's Redis Cloud **Account number** found in the [account settings]({{< relref "/operate/rc/accounts/account-settings" >}}) | + | redisAccountMapping | Key-value pair of a lowercase [role name](/content/operate/rc/security/access-control/access-management.md#team-management-roles) (owner, member, manager, billing_admin, or viewer) and the user's Redis Cloud **Account number** found in the [account settings](/content/operate/rc/accounts/account-settings.md) | For `redisAccountMapping`, you can add the same user to multiple SAML-enabled accounts using one of these options: @@ -164,9 +164,9 @@ Set up a SAML app to integrate Redis Cloud with your identity provider: ``` - {{}} -To confirm the identity provider's SAML assertions contain the required attributes, you can use a SAML-tracer web developer tool to inspect them. - {{}} + > [!NOTE] + > To confirm the identity provider's SAML assertions contain the required attributes, you can use a SAML-tracer web developer tool to inspect them. + > 1. Set up any additional configuration required by your identity provider to ensure you can configure the `redisAccountMapping` attribute for SAML users. @@ -256,11 +256,11 @@ To activate SAML SSO: - Select **SSO** and enter the email address associated with the SAML user configured in your identity provider. Your user converts to a SAML user in Redis Cloud. Don't use this method if you want your user account to remain a local bypass user. - {{}} -If you see a **SAML activation failed** notification when redirected to the Redis Cloud sign-in screen, sign in with your local user credentials and review the SAML configuration for issues. - {{}} + > [!NOTE] + > If you see a **SAML activation failed** notification when redirected to the Redis Cloud sign-in screen, sign in with your local user credentials and review the SAML configuration for issues. + > -After you activate SAML SSO, [add a few local bypass users]({{< relref "/operate/rc/security/access-control/access-management#manage-team-access" >}}) from the **Team** tab. Local bypass users should [set up MFA]({{< relref "/operate/rc/security/access-control/multi-factor-authentication" >}}) for additional security. +After you activate SAML SSO, [add a few local bypass users](/content/operate/rc/security/access-control/access-management.md#manage-team-access) from the **Team** tab. Local bypass users should [set up MFA](/content/operate/rc/security/access-control/multi-factor-authentication.md) for additional security. ## Update configuration {#update-config} @@ -274,9 +274,8 @@ If you change certain metadata or configuration settings after you set up SAML S After you set up SAML SSO for one account, you can link other accounts you own to the existing SAML configuration. This lets you use the same SAML configuration for SSO across multiple accounts. -{{}} -You must have the `Owner` role assigned to your user account for all accounts you want to link. The same user must link each account to the original configuration. -{{}} +> [!NOTE] +> You must have the `Owner` role assigned to your user account for all accounts you want to link. The same user must link each account to the original configuration. To link other accounts to an existing SAML SSO configuration: @@ -324,6 +323,6 @@ To deactivate SAML SSO for a specific account: When a user is removed from your identity provider, their access to Redis Cloud should also be removed. -When you have revoked a user’s access to Redis Cloud, they cannot access the Redis Cloud console, but their API keys remain active. You can [delete an API key]({{< relref "/operate/rc/api/get-started/manage-api-keys#delete-a-user-key" >}}) to remove access. +When you have revoked a user’s access to Redis Cloud, they cannot access the Redis Cloud console, but their API keys remain active. You can [delete an API key](/content/operate/rc/api/get-started/manage-api-keys.md#delete-a-user-key) to remove access. -To deprovision SAML users upon deletion, the identity provider admin can set up a webhook to automatically make the appropriate Cloud API requests. For more information about managing users with API requests, see [Users]({{< relref "/operate/rc/api/api-reference#tag/Users" >}}) in the Redis Cloud API documentation. +To deprovision SAML users upon deletion, the identity provider admin can set up a webhook to automatically make the appropriate Cloud API requests. For more information about managing users with API requests, see [Users](/content/operate/rc/api/api-reference.md#tag/Users) in the Redis Cloud API documentation. diff --git a/content/operate/rc/security/access-control/saml-sso/saml-integration-auth0.md b/content/operate/rc/security/access-control/saml-sso/saml-integration-auth0.md index 046ebee402..94afc61188 100644 --- a/content/operate/rc/security/access-control/saml-sso/saml-integration-auth0.md +++ b/content/operate/rc/security/access-control/saml-sso/saml-integration-auth0.md @@ -14,9 +14,9 @@ bannerText: Specific identity provider details may be different than shown in th This guide shows how to configure [Auth0](https://auth0.com/docs) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account. -To learn more about Redis Cloud support for SAML, see [SAML single sign-on]({{< relref "/operate/rc/security/access-control/saml-sso" >}}). +To learn more about Redis Cloud support for SAML, see [SAML single sign-on](/content/operate/rc/security/access-control/saml-sso/_index.md). -Before completing this guide, you must [verify ownership of any domains]({{< relref "/operate/rc/security/access-control/saml-sso#verify-domain" >}}) you want to associate with your SAML setup. +Before completing this guide, you must [verify ownership of any domains](/content/operate/rc/security/access-control/saml-sso/_index.md#verify-domain) you want to associate with your SAML setup. ## Step 1: Set up your identity provider (IdP) @@ -28,9 +28,9 @@ Before completing this guide, you must [verify ownership of any domains]({{< rel SAML assertion requires first and last name, which are not available in the default user profile. - {{}} -Depending how they are created, users can have different profiles. - {{}} + > [!NOTE] + > Depending how they are created, users can have different profiles. + > {{}} @@ -38,7 +38,7 @@ Depending how they are created, users can have different profiles. {{}} - The key-value pair of `redisAccountMapping` consists of a lowercase role name (owner, member, manager, billing_admin, or viewer) and your Redis Cloud Account ID found in the [account settings]({{< relref "/operate/rc/accounts/account-settings" >}}). + The key-value pair of `redisAccountMapping` consists of a lowercase role name (owner, member, manager, billing_admin, or viewer) and your Redis Cloud Account ID found in the [account settings](/content/operate/rc/accounts/account-settings.md). ```json { @@ -189,9 +189,8 @@ To use IdP-initiated SSO with certain identity providers, you also need to set t `https://cloud.redis.io/#/login/?idpId=` -{{< note >}} -Replace `ID` so it matches the `AssertionConsumerService` Location URL ID (the content after the last forward slash "/"). To learn more about how to configure service provider apps, see your identity provider’s documentation. -{{}} +> [!NOTE] +> Replace `ID` so it matches the `AssertionConsumerService` Location URL ID (the content after the last forward slash "/"). To learn more about how to configure service provider apps, see your identity provider’s documentation. ## Step 4: Return to the Redis Cloud console diff --git a/content/operate/rc/security/access-control/saml-sso/saml-integration-aws-identity-center.md b/content/operate/rc/security/access-control/saml-sso/saml-integration-aws-identity-center.md index 018acb6e64..e1de242ff2 100644 --- a/content/operate/rc/security/access-control/saml-sso/saml-integration-aws-identity-center.md +++ b/content/operate/rc/security/access-control/saml-sso/saml-integration-aws-identity-center.md @@ -14,9 +14,9 @@ bannerText: Specific identity provider details may be different than shown in th This guide shows how to configure [AWS IAM Identity Center](https://aws.amazon.com/iam/identity-center/) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account. -To learn more about Redis Cloud support for SAML, see [SAML single sign-on]({{< relref "/operate/rc/security/access-control/saml-sso" >}}). +To learn more about Redis Cloud support for SAML, see [SAML single sign-on](/content/operate/rc/security/access-control/saml-sso/_index.md). -Before completing this guide, you must [verify ownership of any domains]({{< relref "/operate/rc/security/access-control/saml-sso#verify-domain" >}}) you want to associate with your SAML setup. +Before completing this guide, you must [verify ownership of any domains](/content/operate/rc/security/access-control/saml-sso/_index.md#verify-domain) you want to associate with your SAML setup. ## Step 1: Setup your identity provider (IdP) @@ -52,9 +52,8 @@ Before completing this guide, you must [verify ownership of any domains]({{< rel Note down or copy the URLs and select **Download** to download the certification information. -{{< note >}} -Both the IAM Identity Center sign-in URL and the IAM Identity Center SAML issuer URL are the same value. This is expected. -{{< /note >}} +> [!NOTE] +> Both the IAM Identity Center sign-in URL and the IAM Identity Center SAML issuer URL are the same value. This is expected. {{}} @@ -121,7 +120,7 @@ To activate SAML, you must have a local user (or social sign-on user) with the ` * **LastName**: `${user:familyName}`, `unspecified` * **redisAccountMapping**: `XXXXXXX=owner`, `unspecified` -The `redisAccountMapping` key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your Redis Cloud Account ID found in the [account settings]({{< relref "/operate/rc/accounts/account-settings" >}}). +The `redisAccountMapping` key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your Redis Cloud Account ID found in the [account settings](/content/operate/rc/accounts/account-settings.md). {{}} diff --git a/content/operate/rc/security/access-control/saml-sso/saml-integration-azure-ad.md b/content/operate/rc/security/access-control/saml-sso/saml-integration-azure-ad.md index b18da7b817..e248ea642a 100644 --- a/content/operate/rc/security/access-control/saml-sso/saml-integration-azure-ad.md +++ b/content/operate/rc/security/access-control/saml-sso/saml-integration-azure-ad.md @@ -13,9 +13,9 @@ bannerText: Specific identity provider details may be different than shown in th This guide shows how to configure [Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-architecture) (formerly Azure Active Directory) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account. -To learn more about Redis Cloud support for SAML, see [SAML single sign on]({{< relref "/operate/rc/security/access-control/saml-sso" >}}). +To learn more about Redis Cloud support for SAML, see [SAML single sign on](/content/operate/rc/security/access-control/saml-sso/_index.md). -Before completing this guide, you must [verify ownership of any domains]({{< relref "/operate/rc/security/access-control/saml-sso#verify-domain" >}}) you want to associate with your SAML setup. +Before completing this guide, you must [verify ownership of any domains](/content/operate/rc/security/access-control/saml-sso/_index.md#verify-domain) you want to associate with your SAML setup. ## Step 1: Set up your identity provider (IdP) @@ -112,9 +112,9 @@ To activate SAML, you must have a local user (or social sign-on user) with the * This is where you entered mock data. Let's now enter the correct data for this step. - {{< note >}} - For the `EntityID` and `Location` fields below you can directly upload the metadata file using the option at the top of the page. However, you will still need to manually add the **Sign on URL**. - {{< /note >}} + > [!NOTE] + > For the `EntityID` and `Location` fields below you can directly upload the metadata file using the option at the top of the page. However, you will still need to manually add the **Sign on URL**. + > * Paste `EntityID` information in the `Identifier (Entity ID)` field. @@ -143,17 +143,18 @@ To activate SAML, you must have a local user (or social sign-on user) with the * The `redisAccountMapping` claim maps Redis Cloud accounts to the role each user receives. Its value is a comma-separated list of `accountId=role` pairs, for example `2613034=owner,2923247=member`. - * **`accountId`** must be the numeric **Redis Cloud Account ID** found in your [account settings]({{< relref "/operate/rc/accounts/account-settings" >}}). Non-numeric values are silently skipped. + * **`accountId`** must be the numeric **Redis Cloud Account ID** found in your [account settings](/content/operate/rc/accounts/account-settings.md). Non-numeric values are silently skipped. * **`role`** must be lowercase and one of `owner`, `member`, `manager`, `billing_admin`, or `viewer`. Note the underscore in `billing_admin`. * Redis Cloud reads a **single value** for this claim. If it resolves to multiple values, only one is used — see [Claim conditions and user groups](#claim-conditions-and-user-groups). {{}} - {{}} -Make sure the **Namespace** field is empty when modifying these claims. + > [!NOTE] + > Make sure the **Namespace** field is empty when modifying these claims. + > + > {{}} + > -{{}} - {{}} 1. To add a user to the application, select **User and Groups > Add user/group**. @@ -206,15 +207,14 @@ Microsoft Entra can build the claim value from the names of the groups a user be * **Regex pattern**: `^redis-(?owner|member|manager|billing_admin|viewer)$` * **Replacement pattern**: `={role}` — replace `` with your numeric Redis Cloud Account ID. To map more than one account, comma-join the pairs, for example `2613034={role},2923247={role}`. - {{< warning >}} -The substitution token is `{role}` — **curly braces only**. Do **not** write `${role}`. Entra emits the `$` as a literal character, producing a value like `2613034=$owner`, which Redis Cloud rejects with `saml-config-invalid-account-mapping` because `$owner` is not a valid role token. - {{< /warning >}} + > [!WARNING] + > The substitution token is `{role}` — **curly braces only**. Do **not** write `${role}`. Entra emits the `$` as a literal character, producing a value like `2613034=$owner`, which Redis Cloud rejects with `saml-config-invalid-account-mapping` because `$owner` is not a valid role token. + > 1. Make sure **Emit groups as role claims** is **turned off**. When it is on, the value is emitted under the `http://schemas.microsoft.com/ws/2008/06/identity/claims/role` claim type instead of your custom `redisAccountMapping` claim name, so Redis Cloud never receives the mapping. -{{< note >}} -Set the group claim **Source attribute** to the group **name**, not **Group ID**. If the source is Group ID, the emitted value is a GUID that never matches the `redis-` regex. For groups synced from on-premises Active Directory, use `sAMAccountName`; for cloud-only groups, enable the group-name option. -{{< /note >}} +> [!NOTE] +> Set the group claim **Source attribute** to the group **name**, not **Group ID**. If the source is Group ID, the emitted value is a GUID that never matches the `redis-` regex. For groups synced from on-premises Active Directory, use `sAMAccountName`; for cloud-only groups, enable the group-name option. {{}} @@ -235,7 +235,7 @@ This error means the `redisAccountMapping` claim reached Redis Cloud, but no val * **Stray characters** — most often a literal `$` from writing `${role}` instead of `{role}` in the regex replacement pattern, which produces `accountId=$owner`. * **A wrong role token** — the role must be exactly `owner`, `member`, `manager`, `billing_admin`, or `viewer`, in lowercase. Values like `Owner` or `billing-admin` (hyphen) are rejected. -* **A non-numeric account ID** — `accountId` must be the numeric Redis Cloud Account ID from [account settings]({{< relref "/operate/rc/accounts/account-settings" >}}). +* **A non-numeric account ID** — `accountId` must be the numeric Redis Cloud Account ID from [account settings](/content/operate/rc/accounts/account-settings.md). Multi-group membership (a multi-valued claim) does **not** cause this error. Login succeeds, but the user resolves to a single group's role — see [Users in multiple groups](#users-in-multiple-groups). diff --git a/content/operate/rc/security/access-control/saml-sso/saml-integration-google.md b/content/operate/rc/security/access-control/saml-sso/saml-integration-google.md index 1953a25313..2f05991962 100644 --- a/content/operate/rc/security/access-control/saml-sso/saml-integration-google.md +++ b/content/operate/rc/security/access-control/saml-sso/saml-integration-google.md @@ -14,9 +14,9 @@ bannerText: Specific identity provider details may be different than shown in th This guide shows how to configure [Google Workspace](https://workspace.google.com/) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account. -To learn more about Redis Cloud support for SAML, see [SAML single sign-on]({{< relref "/operate/rc/security/access-control/saml-sso" >}}). +To learn more about Redis Cloud support for SAML, see [SAML single sign-on](/content/operate/rc/security/access-control/saml-sso/_index.md). -Before completing this guide, you must [verify ownership of any domains]({{< relref "/operate/rc/security/access-control/saml-sso#verify-domain" >}}) you want to associate with your SAML setup. +Before completing this guide, you must [verify ownership of any domains](/content/operate/rc/security/access-control/saml-sso/_index.md#verify-domain) you want to associate with your SAML setup. ## Step 1: Set up your identity provider (IdP) @@ -110,7 +110,7 @@ To activate SAML, you must have a local user (or social sign-on user) with the ` {{}} -1. Each user who needs to access Redis Cloud through SAML needs to define the **redisAccountMapping** attribute. The `redisAccountMapping` key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your Redis Cloud Account ID found in the [account settings]({{< relref "/operate/rc/accounts/account-settings" >}}). +1. Each user who needs to access Redis Cloud through SAML needs to define the **redisAccountMapping** attribute. The `redisAccountMapping` key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your Redis Cloud Account ID found in the [account settings](/content/operate/rc/accounts/account-settings.md). {{}} diff --git a/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-generic.md b/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-generic.md index b977226acb..4448f601de 100644 --- a/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-generic.md +++ b/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-generic.md @@ -14,11 +14,11 @@ bannerText: Specific identity provider details may be different than shown in th This guide shows how to configure [Okta](https://help.okta.com/en-us/Content/Topics/Security/Identity_Providers.htm) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account. -Learn how to use the generic application template. You can also refer to the [Org2Org]({{< relref "/operate/rc/security/access-control/saml-sso/saml-integration-okta-org2org" >}}) application template. +Learn how to use the generic application template. You can also refer to the [Org2Org](/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-org2org.md) application template. -To learn more about Redis Cloud support for SAML, see [SAML single sign-on]({{< relref "/operate/rc/security/access-control/saml-sso" >}}). +To learn more about Redis Cloud support for SAML, see [SAML single sign-on](/content/operate/rc/security/access-control/saml-sso/_index.md). -Before completing this guide, you must [verify ownership of any domains]({{< relref "/operate/rc/security/access-control/saml-sso#verify-domain" >}}) you want to associate with your SAML setup. To do this, you must add a DNS TXT record provided by Redis Cloud to each domain; SAML SSO can't be enabled until the domain is verified. +Before completing this guide, you must [verify ownership of any domains](/content/operate/rc/security/access-control/saml-sso/_index.md#verify-domain) you want to associate with your SAML setup. To do this, you must add a DNS TXT record provided by Redis Cloud to each domain; SAML SSO can't be enabled until the domain is verified. ## Step 1: Set up your demo identity provider (IdP) @@ -44,9 +44,9 @@ To create the Okta SAML integration application: 1. In the **Configure SAML** tab, enter this data in the **General** section: - {{}} -Setting up SAML SSO is a two-part handshake. You first create the Okta application with temporary mock URLs so that Redis Cloud can generate its own service provider (SP) metadata. Later, in [Step 3](#step-3-configure-saml-support-in-redis-cloud), you return to this Okta application and replace these mock URLs with the real values from that Redis Cloud SP metadata. - {{}} + > [!NOTE] + > Setting up SAML SSO is a two-part handshake. You first create the Okta application with temporary mock URLs so that Redis Cloud can generate its own service provider (SP) metadata. Later, in [Step 3](#step-3-configure-saml-support-in-redis-cloud), you return to this Okta application and replace these mock URLs with the real values from that Redis Cloud SP metadata. + > * **Single sign-on URL**: `http://www.fake.com`. This is a temporary mock URL that you will modify later. * **Audience URI (SP Entity ID)**: `http://www.fake.com`. This is a temporary mock URL that you will modify later. @@ -81,9 +81,9 @@ Setting up SAML SSO is a two-part handshake. You first create the Okta applicati {{}} - {{}} -The `redisAccountMapping` attribute is required. If it's missing or malformed, SAML activation and subsequent SAML logins fail. - {{}} + > [!NOTE] + > The `redisAccountMapping` attribute is required. If it's missing or malformed, SAML activation and subsequent SAML logins fail. + > Select **Next**. @@ -170,11 +170,11 @@ Now that your group is populated with its users, you can assign the SAML integra {{}} -1. Define the Redis account mapping string default for this group and select **Save and Go Back**. The key-value pair consists of your **Redis Cloud Account ID** found in the [account settings]({{< relref "/operate/rc/accounts/account-settings" >}}) and the lowercase role name (owner, member, manager, billing_admin, or viewer) — for example, `1937217=viewer`. Select **"Done"**. +1. Define the Redis account mapping string default for this group and select **Save and Go Back**. The key-value pair consists of your **Redis Cloud Account ID** found in the [account settings](/content/operate/rc/accounts/account-settings.md) and the lowercase role name (owner, member, manager, billing_admin, or viewer) — for example, `1937217=viewer`. Select **"Done"**. - {{}} -Role values must be lowercase. A value like `1937217=Viewer` or `1937217=VIEWER` is rejected. - {{}} + > [!NOTE] + > Role values must be lowercase. A value like `1937217=Viewer` or `1937217=VIEWER` is rejected. + > {{}} @@ -226,9 +226,8 @@ Sign in to your account on the [Redis Cloud console](https://cloud.redis.io/#/lo To activate SAML, you must have a local user (or social sign-on user) with the **owner** role. If you have the correct permissions, you will see the **Single Sign-On** tab. -{{}} -The user who activates SAML must have `ACCOUNT_ID=owner` in their `redisAccountMapping` value, where `ACCOUNT_ID` is the Redis Cloud account being configured. Activation fails if this user's mapping doesn't grant the owner role on that account. -{{}} +> [!NOTE] +> The user who activates SAML must have `ACCOUNT_ID=owner` in their `redisAccountMapping` value, where `ACCOUNT_ID` is the Redis Cloud account being configured. Activation fails if this user's mapping doesn't grant the owner role on that account. 1. Fill in the information you saved in step 6 in the **setup** form, including: @@ -236,9 +235,9 @@ The user who activates SAML must have `ACCOUNT_ID=owner` in their `redisAccountM * **Issuer**: Identity Provider Issuer * **Assertion signing certificate**: X.509 Certificate - {{}} -Paste the X.509 certificate exactly as Okta provides it. Don't add `-----BEGIN CERTIFICATE-----`/`-----END CERTIFICATE-----` headers unless the Redis Cloud UI specifically asks for them. - {{}} + > [!NOTE] + > Paste the X.509 certificate exactly as Okta provides it. Don't add `-----BEGIN CERTIFICATE-----`/`-----END CERTIFICATE-----` headers unless the Redis Cloud UI specifically asks for them. + > {{}} diff --git a/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-org2org.md b/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-org2org.md index 6405803930..4410c9e5ba 100644 --- a/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-org2org.md +++ b/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-org2org.md @@ -14,11 +14,11 @@ bannerText: Specific identity provider details may be different than shown in th This guide shows how to configure [Okta](https://help.okta.com/en-us/Content/Topics/Security/Identity_Providers.htm) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account. -This guide shows how to use the Org2Org application template. You can also use the [Generic]({{< relref "/operate/rc/security/access-control/saml-sso/saml-integration-okta-generic" >}}) application template. +This guide shows how to use the Org2Org application template. You can also use the [Generic](/content/operate/rc/security/access-control/saml-sso/saml-integration-okta-generic.md) application template. -To learn more about Redis Cloud support for SAML, see [SAML single sign-on]({{< relref "/operate/rc/security/access-control/saml-sso" >}}). +To learn more about Redis Cloud support for SAML, see [SAML single sign-on](/content/operate/rc/security/access-control/saml-sso/_index.md). -Before completing this guide, you must [verify ownership of any domains]({{< relref "/operate/rc/security/access-control/saml-sso#verify-domain" >}}) you want to associate with your SAML setup. +Before completing this guide, you must [verify ownership of any domains](/content/operate/rc/security/access-control/saml-sso/_index.md#verify-domain) you want to associate with your SAML setup. ## Step 1: Set up your identity provider @@ -52,9 +52,10 @@ Create an Okta "Org2Org" SAML integration appliction. * **Name Format**: `Basic` * **Value**: `appuser.redisAccountMapping` - {{< warning >}} -To ensure the role mapping will not take effect, don't skip entering `appuser.redisAccountMapping` in the **Value** field. - {{< /warning >}} + > [!WARNING] + > To ensure the role mapping will not take effect, don't skip entering `appuser.redisAccountMapping` in the **Value** field. + > + {{Use the Okta admin console to locate the Org2Org application template.}} @@ -141,7 +142,7 @@ Now that your group is populated with its users, assign the SAML integration app {{Use the Okta admin console to locate the Org2Org application template.}} -1. Now, define the Redis account mapping string default for this group and select **Save and go back**. The key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your **Redis Cloud Account ID** found in the [account settings]({{< relref "/operate/rc/accounts/account-settings" >}}). Select **"Done"**. +1. Now, define the Redis account mapping string default for this group and select **Save and go back**. The key-value pair consists of the lowercase role name (owner, member, manager, billing_admin, or viewer) and your **Redis Cloud Account ID** found in the [account settings](/content/operate/rc/accounts/account-settings.md). Select **"Done"**. {{Use the Okta admin console to locate the Org2Org application template.}} @@ -232,9 +233,8 @@ Select **Save**. To use IdP-initiated SSO with identity providers, set the RelayState parameter to URL `https://cloud.redis.io/#/login/?idpId=`. -{{< note >}} -Replace `` so it matches the AssertionConsumerService Location URL ID (the content after the last forward slash "/"). To learn more about configuring service provider applications, see your identity provider's documentation. -{{< /note >}} +> [!NOTE] +> Replace `` so it matches the AssertionConsumerService Location URL ID (the content after the last forward slash "/"). To learn more about configuring service provider applications, see your identity provider's documentation. ### Return to Redis Cloud console diff --git a/content/operate/rc/security/access-control/saml-sso/saml-integration-ping-identity.md b/content/operate/rc/security/access-control/saml-sso/saml-integration-ping-identity.md index 5e4c9e1982..9c7289a86f 100644 --- a/content/operate/rc/security/access-control/saml-sso/saml-integration-ping-identity.md +++ b/content/operate/rc/security/access-control/saml-sso/saml-integration-ping-identity.md @@ -14,9 +14,9 @@ bannerText: Specific identity provider details may be different than shown in th This guide shows how to configure [PingIdentity](https://docs.pingidentity.com/) as a SAML single sign-on identity provider (IdP) for your Redis Cloud account. -To learn more about Redis Cloud support for SAML, see [SAML single sign-on]({{< relref "/operate/rc/security/access-control/saml-sso" >}}). +To learn more about Redis Cloud support for SAML, see [SAML single sign-on](/content/operate/rc/security/access-control/saml-sso/_index.md). -Before completing this guide, you must [verify ownership of any domains]({{< relref "/operate/rc/security/access-control/saml-sso#verify-domain" >}}) you want to associate with your SAML setup. +Before completing this guide, you must [verify ownership of any domains](/content/operate/rc/security/access-control/saml-sso/_index.md#verify-domain) you want to associate with your SAML setup. ## Step 1: Set up your identity provider (IdP) @@ -52,7 +52,7 @@ Before completing this guide, you must [verify ownership of any domains]({{< rel * **redisAccountMapping**: `{accountID}={role}` - **accountID** is the account ID from [account settings]({{< relref "/operate/rc/accounts/account-settings" >}}) and **role** represents the role that the user will be assigned in Redis Cloud console (owner, member, manager, billing_admin, or viewer): + **accountID** is the account ID from [account settings](/content/operate/rc/accounts/account-settings.md) and **role** represents the role that the user will be assigned in Redis Cloud console (owner, member, manager, billing_admin, or viewer): {{}} diff --git a/content/operate/rc/security/access-control/social-login.md b/content/operate/rc/security/access-control/social-login.md index 6176773ea3..ebe1d388e1 100644 --- a/content/operate/rc/security/access-control/social-login.md +++ b/content/operate/rc/security/access-control/social-login.md @@ -14,9 +14,8 @@ Redis Cloud supports the following social logins: - [GitHub](https://github.com/) - [Google](https://accounts.google.com/) -{{}} -If your Google and GitHub accounts share an email address (such as Gmail), you can use either one to sign in to the same Redis Cloud account. -{{}} +> [!NOTE] +> If your Google and GitHub accounts share an email address (such as Gmail), you can use either one to sign in to the same Redis Cloud account. ## Create a new account with social login @@ -32,17 +31,15 @@ To set up GitHub login: 2. Sign in with the Github account you would like to use. 3. Select **Authorize** on the **Authorize Redis Okta Auth Github** prompt. -{{}} -If the email address associated with your GitHub account is not public, you will see an error message that your sign in attempt failed. You need to [make your email address public](https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences) on GitHub before you try again. -{{}} +> [!NOTE] +> If the email address associated with your GitHub account is not public, you will see an error message that your sign in attempt failed. You need to [make your email address public](https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences) on GitHub before you try again. ## Migrate an existing account to social login If you already have a Redis Cloud account that requires an email address and password to sign in, you can migrate your existing account to use a social login associated with that same email address instead. -{{}} -Once you migrate your account to use social login, you cannot revert to your old email/password sign in method. -{{}} +> [!WARNING] +> Once you migrate your account to use social login, you cannot revert to your old email/password sign in method. To migrate your account to Google social login: diff --git a/content/operate/rc/security/aws-privatelink.md b/content/operate/rc/security/aws-privatelink.md index 0ec4066b2e..44c12e0a2a 100644 --- a/content/operate/rc/security/aws-privatelink.md +++ b/content/operate/rc/security/aws-privatelink.md @@ -12,11 +12,10 @@ weight: 80 [Amazon Web Services (AWS) PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-resources.html) allows service providers to securely expose specific services without exposing the entire service provider and consumer VPCs to each other. With AWS PrivateLink, Redis Cloud exposes a VPC endpoint service that you connect to as a consumer from your own VPC. Traffic stays within the AWS network and is isolated from external networks. -{{< note >}} -Connecting to Redis Cloud with an AWS PrivateLink is available only with Redis Cloud Pro. It is not supported for Redis Cloud Essentials. -{{< /note >}} +> [!NOTE] +> Connecting to Redis Cloud with an AWS PrivateLink is available only with Redis Cloud Pro. It is not supported for Redis Cloud Essentials. -You can use PrivateLink as an alternative to Layer 3 connectivity options like [VPC peering]({{< relref "/operate/rc/security/vpc-peering" >}}) and [Transit Gateway]({{< relref "/operate/rc/security/aws-transit-gateway" >}}). +You can use PrivateLink as an alternative to Layer 3 connectivity options like [VPC peering](/content/operate/rc/security/vpc-peering.md) and [Transit Gateway](/content/operate/rc/security/aws-transit-gateway.md). AWS PrivateLink provides the following benefits: @@ -51,7 +50,7 @@ Be aware of the following limitations when using PrivateLink with Redis Cloud: Before you can connect to Redis Cloud with an AWS PrivateLink VPC resource endpoint, you must have: -- A [Redis Cloud Pro database]({{< relref "/operate/rc/databases/create-database/create-pro-database-new" >}}) and the **Owner** or **Manager** role for your Redis Cloud account. +- A [Redis Cloud Pro database](/content/operate/rc/databases/create-database/create-pro-database-new.md) and the **Owner** or **Manager** role for your Redis Cloud account. - An [AWS VPC](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html) with the following: - A [security group](https://docs.aws.amazon.com/vpc/latest/userguide/creating-security-groups.html) that allows ingress traffic to the following ports: - The database port range (port 10000-19999) @@ -177,13 +176,12 @@ The script returns a list of database endpoints that you can connect to from you ] ``` -You can connect to your database by using the database `private-dns-entry` and `port` from your consumer VPC. You can also connect to the metrics endpoint with services like [Prometheus and Grafana]({{< relref "/integrate/prometheus-with-redis-cloud/" >}}) by using the metrics `private-dns-entry` and `port`. +You can connect to your database by using the database `private-dns-entry` and `port` from your consumer VPC. You can also connect to the metrics endpoint with services like [Prometheus and Grafana](/content/integrate/prometheus-with-redis-cloud/_index.md) by using the metrics `private-dns-entry` and `port`. -After you've connected to your database, you can view the connection details in the Redis Cloud console in your subscription's **Connectivity > PrivateLink** tab or by going to the [connection wizard]({{< relref "/operate/rc/databases/connect" >}}) for your database. The private endpoint will point to the PrivateLink VPC resource endpoint or service network that you created. +After you've connected to your database, you can view the connection details in the Redis Cloud console in your subscription's **Connectivity > PrivateLink** tab or by going to the [connection wizard](/content/operate/rc/databases/connect/_index.md) for your database. The private endpoint will point to the PrivateLink VPC resource endpoint or service network that you created. -{{< note >}} -The connection wizard and other parts of the console show your database's [public endpoint]({{< relref "/operate/rc/databases/connect" >}}), which is different from the `private-dns-entry` the discovery script returns. The public endpoint hostname is publicly resolvable and, by default, returns your database's address inside the Redis-managed VPC. That's correct behavior, and it's what [VPC peering]({{< relref "/operate/rc/security/vpc-peering" >}}) and [Transit Gateway]({{< relref "/operate/rc/security/aws-transit-gateway" >}}) consumers rely on. For PrivateLink, that address is overridden only inside your consumer VPC, by the private hosted zone that AWS creates there. Resolving the public endpoint hostname from anywhere else — including from on-premises over Direct Connect or a VPN — returns the unreachable Redis-managed VPC address, not an error. Use the database's `private-dns-entry` from your consumer VPC, or see [Connect from on-premises](#connect-from-on-premises) if you're connecting from outside it. -{{< /note >}} +> [!NOTE] +> The connection wizard and other parts of the console show your database's [public endpoint](/content/operate/rc/databases/connect/_index.md), which is different from the `private-dns-entry` the discovery script returns. The public endpoint hostname is publicly resolvable and, by default, returns your database's address inside the Redis-managed VPC. That's correct behavior, and it's what [VPC peering](/content/operate/rc/security/vpc-peering.md) and [Transit Gateway](/content/operate/rc/security/aws-transit-gateway.md) consumers rely on. For PrivateLink, that address is overridden only inside your consumer VPC, by the private hosted zone that AWS creates there. Resolving the public endpoint hostname from anywhere else — including from on-premises over Direct Connect or a VPN — returns the unreachable Redis-managed VPC address, not an error. Use the database's `private-dns-entry` from your consumer VPC, or see [Connect from on-premises](#connect-from-on-premises) if you're connecting from outside it. ## Connect from on-premises diff --git a/content/operate/rc/security/aws-transit-gateway.md b/content/operate/rc/security/aws-transit-gateway.md index a071120276..353645ff37 100644 --- a/content/operate/rc/security/aws-transit-gateway.md +++ b/content/operate/rc/security/aws-transit-gateway.md @@ -20,13 +20,12 @@ weight: 80 You can connect your Redis Cloud Pro subscription to a Transit Gateway which is attached to the VPC of your application. This lets your application connect securely to your Redis Cloud database while optimizing performance. -{{< note >}} -Transit Gateway is available only with Redis Cloud Pro. It is not supported for Redis Cloud Essentials. -{{< /note >}} +> [!NOTE] +> Transit Gateway is available only with Redis Cloud Pro. It is not supported for Redis Cloud Essentials. ## Considerations -You can use Transit Gateway as an alternative to [VPC peering]({{< relref "/operate/rc/security/vpc-peering" >}}), or you can enable both for your subscription. +You can use Transit Gateway as an alternative to [VPC peering](/content/operate/rc/security/vpc-peering.md), or you can enable both for your subscription. Compared to VPC peering, Transit Gateway: @@ -46,13 +45,12 @@ Consider using VPC peering and Transit Gateway in parallel for the following sit Before you can set up Transit Gateway, you need to: -1. [Create a database with Redis Cloud Pro]({{< relref "/operate/rc/databases/create-database/create-pro-database-new" >}}) from the [Redis Cloud console](https://cloud.redis.io/#/). +1. [Create a database with Redis Cloud Pro](/content/operate/rc/databases/create-database/create-pro-database-new.md) from the [Redis Cloud console](https://cloud.redis.io/#/). 1. [Create a transit gateway](https://docs.aws.amazon.com/vpc/latest/tgw/create-tgw.html) from the [AWS VPC console](https://console.aws.amazon.com/vpc/) in the same region as your database. -{{< note >}} -If you use Redis Cloud Bring your own Cloud, you will need to set its IAM Instance Policy to include Transit Gateway. See [Create IAM resources using the AWS console]({{< relref "/operate/rc/subscriptions/bring-your-own-cloud/iam-resources/aws-console.md" >}}) for more information. -{{< /note >}} +> [!NOTE] +> If you use Redis Cloud Bring your own Cloud, you will need to set its IAM Instance Policy to include Transit Gateway. See [Create IAM resources using the AWS console](/content/operate/rc/subscriptions/bring-your-own-cloud/iam-resources/aws-console.md) for more information. ## AWS Transit Gateway @@ -156,9 +154,8 @@ To finish Transit gateway setup, [update your route tables for the peering conne After Transit gateway is established, we recommend switching your application connection string to the private endpoint. -{{< note >}} -If you've enabled the database's [CIDR allow list]({{< relref "/operate/rc/security/cidr-whitelist" >}}), you must also [add the Transit Gateway's IP address to the CIDR allow list]({{< relref "/operate/rc/security/cidr-whitelist#define-cidr-allow-list" >}}) to connect to the database via the private endpoint. -{{< /note >}} +> [!NOTE] +> If you've enabled the database's [CIDR allow list](/content/operate/rc/security/cidr-whitelist.md), you must also [add the Transit Gateway's IP address to the CIDR allow list](/content/operate/rc/security/cidr-whitelist.md#define-cidr-allow-list) to connect to the database via the private endpoint. ## Continue learning with Redis University diff --git a/content/operate/rc/security/cidr-whitelist.md b/content/operate/rc/security/cidr-whitelist.md index 3dde3ab3f7..a6df0d3c92 100644 --- a/content/operate/rc/security/cidr-whitelist.md +++ b/content/operate/rc/security/cidr-whitelist.md @@ -14,9 +14,8 @@ weight: 30 The [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) [allow list](https://en.wikipedia.org/wiki/Whitelist) lets you restrict traffic to your Redis Cloud database. When you configure an allow list, only the [IP addresses](https://en.wikipedia.org/wiki/IP_address) defined in the list can connect to the database. Traffic from all other IP addresses is blocked. -{{< note >}} -To use the CIDR allow list, you must be on either paid Redis Cloud Essentials or on Redis Cloud Pro. This feature is not supported on free Redis Cloud Essentials plans. -{{< /note >}} +> [!NOTE] +> To use the CIDR allow list, you must be on either paid Redis Cloud Essentials or on Redis Cloud Pro. This feature is not supported on free Redis Cloud Essentials plans. ## Define CIDR allow list @@ -44,14 +43,12 @@ To define the CIDR allow list for a database: 1. Select **Save database** to apply your changes. -{{< note >}} -The database CIDR allow list applies to both the public endpoint and the private endpoint. If you use connectivity options such as [VPC Peering]({{< relref "/operate/rc/security/vpc-peering" >}}) and [Transit Gateway]({{< relref "/operate/rc/security/aws-transit-gateway" >}}) to connect to your database via the private endpoint, you must also add those IPs to your database's CIDR allow list. -{{< /note >}} +> [!NOTE] +> The database CIDR allow list applies to both the public endpoint and the private endpoint. If you use connectivity options such as [VPC Peering](/content/operate/rc/security/vpc-peering.md) and [Transit Gateway](/content/operate/rc/security/aws-transit-gateway.md) to connect to your database via the private endpoint, you must also add those IPs to your database's CIDR allow list.   -{{< note >}} -If the target database has a CIDR allow list, you must add the Redis Data Integration (RDI) pipeline's CIDR to the target database's CIDR allow list. Otherwise, the RDI pipeline can't access the database. The RDI pipeline's CIDR is displayed in the [**Workspace details**]({{< relref "/operate/rc/rdi/create-workspace" >}}) modal. -{{< /note >}} +> [!NOTE] +> If the target database has a CIDR allow list, you must add the Redis Data Integration (RDI) pipeline's CIDR to the target database's CIDR allow list. Otherwise, the RDI pipeline can't access the database. The RDI pipeline's CIDR is displayed in the [**Workspace details**](/content/operate/rc/rdi/create-workspace.md) modal. ## Continue learning with Redis University diff --git a/content/operate/rc/security/database-security/_index.md b/content/operate/rc/security/database-security/_index.md index 90a3de3d62..3a3a30b1ac 100644 --- a/content/operate/rc/security/database-security/_index.md +++ b/content/operate/rc/security/database-security/_index.md @@ -11,29 +11,29 @@ weight: 20 --- Redis Cloud provides several features to help you secure your databases. These include -[password-based authentication]({{< relref "/operate/rc/security/access-control/data-access-control/default-user" >}}) and [role-based access control]({{< relref "/operate/rc/security/access-control/data-access-control/role-based-access-control.md" >}}), -[network security]({{< relref "/operate/rc/security/database-security/network-security.md" >}}), [TLS]({{< relref "/operate/rc/security/database-security/tls-ssl.md" >}}), and [encryption-at-rest]({{< relref "/operate/rc/security/encryption-at-rest.md" >}}). +[password-based authentication](/content/operate/rc/security/access-control/data-access-control/default-user.md) and [role-based access control](/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md), +[network security](/content/operate/rc/security/database-security/network-security.md), [TLS](/content/operate/rc/security/database-security/tls-ssl.md), and [encryption-at-rest](/content/operate/rc/security/encryption-at-rest.md). ## Passwords, users, and roles -All Redis Cloud databases [require a password]({{< relref "/operate/rc/security/access-control/data-access-control/default-user" >}}) to connect. However, we recommend enabling [role-based access control]({{< relref "/operate/rc/security/access-control/data-access-control/role-based-access-control.md" >}}) (RBAC) for additional security. With RBAC, you can define +All Redis Cloud databases [require a password](/content/operate/rc/security/access-control/data-access-control/default-user.md) to connect. However, we recommend enabling [role-based access control](/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md) (RBAC) for additional security. With RBAC, you can define all the roles you need, with the appropriate permissions, and assign those roles to your users. ## Network security -Redis Cloud supports two types of network security: [IP Restrictions]({{< relref "/operate/rc/security/database-security/network-security.md" >}}#ip) and [VPCs]({{< relref "/operate/rc/security/database-security/network-security.md" >}}#virtual-private-clouds). We recommend that you employ at least one of these network security options to constrain access to your databases. +Redis Cloud supports two types of network security: [IP Restrictions](/content/operate/rc/security/database-security/network-security.md#ip) and [VPCs](/content/operate/rc/security/database-security/network-security.md#virtual-private-clouds). We recommend that you employ at least one of these network security options to constrain access to your databases. ## Transport Layer Security (TLS) -Redis Cloud supports [Transport Layer Security]({{< relref "/operate/rc/security/database-security/tls-ssl.md" >}}) (TLS) for database access. TLS, often called "SSL", ensures the privacy of the TCP connection between your application and database. When client +Redis Cloud supports [Transport Layer Security](/content/operate/rc/security/database-security/tls-ssl.md) (TLS) for database access. TLS, often called "SSL", ensures the privacy of the TCP connection between your application and database. When client authentication is activated, TLS ensures that only clients with an authorized key can access to your Redis databases. We strongly recommend enabling TLS for any application transmitting sensitive data across the wire. ## Disk encryption -Redis Cloud provides encryption for all data stored on disk in Redis databases. See our [encryption at rest documentation]({{< relref "/operate/rc/security/encryption-at-rest.md" >}}) for specific details. +Redis Cloud provides encryption for all data stored on disk in Redis databases. See our [encryption at rest documentation](/content/operate/rc/security/encryption-at-rest.md) for specific details. ## Continue learning with Redis University diff --git a/content/operate/rc/security/database-security/block-public-endpoints.md b/content/operate/rc/security/database-security/block-public-endpoints.md index 4d705380a9..05b54e8f38 100644 --- a/content/operate/rc/security/database-security/block-public-endpoints.md +++ b/content/operate/rc/security/database-security/block-public-endpoints.md @@ -15,9 +15,8 @@ Public endpoints are accessible from the public internet and don't require a pri Users with Redis Cloud Pro databases can choose to block public endpoints for all databases in their subscription. -{{< note >}} -After you block your database's public endpoint, any connection from an IP address that is not part of the private address space defined in [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918#section-3) will be rejected. Ensure that all connections to your database are made through a private connectivity method before blocking the public endpoint. -{{< /note >}} +> [!NOTE] +> After you block your database's public endpoint, any connection from an IP address that is not part of the private address space defined in [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918#section-3) will be rejected. Ensure that all connections to your database are made through a private connectivity method before blocking the public endpoint. ## Block public endpoints @@ -25,12 +24,12 @@ You can block public endpoints for a [new subscription](#new-subscription) or an ### New subscription -To block the public endpoints when you [create a new Pro subscription]({{< relref "/operate/rc/databases/create-database/create-pro-database-new" >}}): +To block the public endpoints when you [create a new Pro subscription](/content/operate/rc/databases/create-database/create-pro-database-new.md): -1. Follow the instructions to [create a Pro database with custom settings]({{< relref "/operate/rc/databases/create-database/create-pro-database-new#custom-settings" >}}). +1. Follow the instructions to [create a Pro database with custom settings](/content/operate/rc/databases/create-database/create-pro-database-new.md#custom-settings). 1. On the **Setup** tab, go to **Advanced options > Security** to select persistent storage encryption options. 1. Select **Block public endpoint** to block the public endpoint for all databases on the subscription. -1. Select **Continue** to go to the [Sizing tab]({{< relref "/operate/rc/databases/create-database/create-pro-database-new#sizing-tab" >}}). Follow the instructions to provision your database(s). +1. Select **Continue** to go to the [Sizing tab](/content/operate/rc/databases/create-database/create-pro-database-new.md#sizing-tab). Follow the instructions to provision your database(s). After you block the public endpoints for a new subscription, you will need to set up a [private connectivity method](#private-connectivity-methods) to connect to your databases. @@ -51,7 +50,7 @@ After your changes are saved, any incoming connections to the public endpoint of ## Turn on passwordless authentication for the default user -If you have blocked the public endpoint for your Redis Cloud Pro subscription, you can turn on passwordless authentication for the [default user]({{< relref "/operate/rc/security/access-control/data-access-control/default-user" >}}) for any database in that subscription. +If you have blocked the public endpoint for your Redis Cloud Pro subscription, you can turn on passwordless authentication for the [default user](/content/operate/rc/security/access-control/data-access-control/default-user.md) for any database in that subscription. To turn on passwordless authentication: @@ -63,6 +62,6 @@ To turn on passwordless authentication: ## Private connectivity methods Redis Cloud supports the following private connectivity options: -- [VPC peering]({{< relref "/operate/rc/security/vpc-peering" >}}) -- [Google Cloud Private Service Connect]({{< relref "/operate/rc/security/private-service-connect" >}}) _(Google Cloud only)_ -- [AWS Transit Gateway]({{< relref "/operate/rc/security/aws-transit-gateway" >}}) or [AWS PrivateLink]({{< relref "/operate/rc/security/aws-privatelink" >}}) _(AWS only)_ \ No newline at end of file +- [VPC peering](/content/operate/rc/security/vpc-peering.md) +- [Google Cloud Private Service Connect](/content/operate/rc/security/private-service-connect.md) _(Google Cloud only)_ +- [AWS Transit Gateway](/content/operate/rc/security/aws-transit-gateway.md) or [AWS PrivateLink](/content/operate/rc/security/aws-privatelink.md) _(AWS only)_ \ No newline at end of file diff --git a/content/operate/rc/security/database-security/network-security.md b/content/operate/rc/security/database-security/network-security.md index 666a2eed44..66fc94daaf 100644 --- a/content/operate/rc/security/database-security/network-security.md +++ b/content/operate/rc/security/database-security/network-security.md @@ -26,25 +26,25 @@ You can restrict database access to a configurable set of source IP addresses and subnets. This is roughly equivalent to using [iptables](https://en.wikipedia.org/wiki/Iptables) to limit access to a host. -To restrict a database to a specific set of source IP addresses or subnets, see [Configure CIDR allow list]({{< relref "/operate/rc/security/cidr-whitelist" >}}). +To restrict a database to a specific set of source IP addresses or subnets, see [Configure CIDR allow list](/content/operate/rc/security/cidr-whitelist.md). ## Virtual private clouds A [Virtual Private Cloud](https://en.wikipedia.org/wiki/Virtual_private_cloud) (VPC) is an isolated set of resources within a [public cloud](https://en.wikipedia.org/wiki/Cloud_computing#Public_cloud), usually having its own subnets and VLAN. -Redis Cloud Pro databases are almost always deployed in a Redis VPC. In most cases, you'll need to create a [VPC peering connection]({{< relref "/operate/rc/security/vpc-peering" >}}) to access these databases. A VPC peering connection allows unrestricted network access between two VPCs. +Redis Cloud Pro databases are almost always deployed in a Redis VPC. In most cases, you'll need to create a [VPC peering connection](/content/operate/rc/security/vpc-peering.md) to access these databases. A VPC peering connection allows unrestricted network access between two VPCs. Connection creation and supported features vary by public cloud provider. Learn more about VPC usage for [AWS](#vpcs-with-aws), [Google Cloud](#vpcs-with-google-cloud), and [Azure](#vpcs-with-azure). ### VPCs with AWS -Subscriptions that run on AWS support two VPC options. To ensure that that you can securely connect to your database, you need to [create a VPC peering connection]({{< relref "/operate/rc/security/vpc-peering#aws-vpc-peering" >}}). +Subscriptions that run on AWS support two VPC options. To ensure that that you can securely connect to your database, you need to [create a VPC peering connection](/content/operate/rc/security/vpc-peering.md#aws-vpc-peering). -If you create a VPC peering connection, you can also [configure a CIDR allow list]({{< relref "/operate/rc/security/cidr-whitelist" >}}) to allow connections only from specific IP address blocks or security groups. +If you create a VPC peering connection, you can also [configure a CIDR allow list](/content/operate/rc/security/cidr-whitelist.md) to allow connections only from specific IP address blocks or security groups. ### VPCs with Google Cloud -Subscriptions that run on Google Cloud *require* a VPC peering connection. See [Google Cloud VPC peering]({{< relref "/operate/rc/security/vpc-peering#gcp-vpc-peering" >}}) to learn how to set up VPC peering for Google Cloud. +Subscriptions that run on Google Cloud *require* a VPC peering connection. See [Google Cloud VPC peering](/content/operate/rc/security/vpc-peering.md#gcp-vpc-peering) to learn how to set up VPC peering for Google Cloud. ### VPCs with Azure diff --git a/content/operate/rc/security/database-security/tls-ssl.md b/content/operate/rc/security/database-security/tls-ssl.md index 53a06236df..f0fac26b54 100644 --- a/content/operate/rc/security/database-security/tls-ssl.md +++ b/content/operate/rc/security/database-security/tls-ssl.md @@ -14,9 +14,8 @@ Transport Layer Security (TLS) uses encryption to secure [network communications Paid Redis Cloud Essentials plans and Redis Cloud Pro plans can use TLS to encrypt data communications between applications and Redis databases. -{{}} -TLS is not available for Free Redis Cloud Essentials plans. -{{}} +> [!NOTE] +> TLS is not available for Free Redis Cloud Essentials plans. ## TLS recommendations @@ -81,9 +80,9 @@ To enable TLS for a Redis Cloud database: - `redis-db-.key` – the certificate's private key. - {{}} -You must download the certificate using the button at this point. After your changes have been applied, the full bundle of public and private keys will no longer be available for download. - {{}} + > [!NOTE] + > You must download the certificate using the button at this point. After your changes have been applied, the full bundle of public and private keys will no longer be available for download. + > - If you provide a client certificate or a certificate chain, you will see the certificate details before you save your changes. @@ -99,11 +98,10 @@ You must download the certificate using the button at this point. After your ch {{Use the Save database button to save database changes.}} -{{}} -- When you enable or turn off TLS, the change applies to new connections but does not affect existing connections. Clients must close existing connections and reconnect to apply the change. - -- Once you've enabled TLS, all client connections to your database must use TLS. Unencrypted connections will no longer be permitted. -{{}} +> [!NOTE] +> - When you enable or turn off TLS, the change applies to new connections but does not affect existing connections. Clients must close existing connections and reconnect to apply the change. +> +> - Once you've enabled TLS, all client connections to your database must use TLS. Unencrypted connections will no longer be permitted. ## Connect over TLS @@ -138,9 +136,8 @@ The download contains a file called `redis_ca.pem`, which includes the following - Publicly trusted GlobalSign Root CA -{{}} -The downloaded PEM file contains multiple certificates. Make sure to import **all** certificates to your client trust store. If your client code is not implemented properly, it may only import the first certificate. -{{}} +> [!NOTE] +> The downloaded PEM file contains multiple certificates. Make sure to import **all** certificates to your client trust store. If your client code is not implemented properly, it may only import the first certificate. To inspect the certificates in `redis_ca.pem`, run the `keytool` command: @@ -155,7 +152,7 @@ If your database requires client authentication, you also need the public (`redi ### Connect with the Redis CLI -Here's how to use the [Redis CLI]({{< relref "/operate/rs/references/cli-utilities/redis-cli" >}}) to connect to a TLS-enabled Redis Cloud database. +Here's how to use the [Redis CLI](/content/operate/rs/references/cli-utilities/redis-cli/_index.md) to connect to a TLS-enabled Redis Cloud database. Endpoint and port details are available from the **Databases** list or the database's **Configuration** screen. diff --git a/content/operate/rc/security/encryption-at-rest.md b/content/operate/rc/security/encryption-at-rest.md index 0ccb13fb2b..4899398698 100644 --- a/content/operate/rc/security/encryption-at-rest.md +++ b/content/operate/rc/security/encryption-at-rest.md @@ -8,7 +8,7 @@ categories: description: Describes when data is encrypted at rest. weight: 40 --- -Redis Cloud databases write their data to disk whenever [persistence]({{< relref "/operate/rc/databases/configuration/data-persistence.md" >}}) is enabled. +Redis Cloud databases write their data to disk whenever [persistence](/content/operate/rc/databases/configuration/data-persistence.md) is enabled. Redis Cloud deployments are always encrypted at rest. diff --git a/content/operate/rc/security/private-service-connect.md b/content/operate/rc/security/private-service-connect.md index b24c91d3c9..7717693ac5 100644 --- a/content/operate/rc/security/private-service-connect.md +++ b/content/operate/rc/security/private-service-connect.md @@ -18,7 +18,7 @@ This feature is only available for Redis Cloud Pro subscriptions hosted on Googl ## Considerations -You can use Private Service Connect as an alternative to [VPC peering]({{< relref "/operate/rc/security/vpc-peering" >}}), or you can enable both for your subscription. +You can use Private Service Connect as an alternative to [VPC peering](/content/operate/rc/security/vpc-peering.md), or you can enable both for your subscription. Compared to VPC peering, Private Service Connect: @@ -28,9 +28,9 @@ Compared to VPC peering, Private Service Connect: - Has slightly higher network latency than VPC peering due to load balancing requirements. - {{}} -Larger clusters are more likely to experience increased latency with Private Service Connect versus VPC peering. - {{}} + > [!NOTE] + > Larger clusters are more likely to experience increased latency with Private Service Connect versus VPC peering. + > Consider using VPC peering and Private Service Connect in parallel for the following situations: @@ -91,9 +91,9 @@ Now that you have a pending Private Service Connect entry, you need to create th 1. If you have not already done so, [enable Cloud DNS](https://cloud.google.com/dns/docs/set-up-dns-records-domain-name) for your Google Cloud project. - {{}} -Since it can take some time for the DNS changes to become active, we recommend you wait 10 minutes before running the `gcloud` script in the next steps. - {{}} + > [!NOTE] + > Since it can take some time for the DNS changes to become active, we recommend you wait 10 minutes before running the `gcloud` script in the next steps. + > 1. If you already have a copy of the `gcloud` script shown earlier during the **Add connections** step, you can continue to the next step. @@ -105,9 +105,9 @@ Since it can take some time for the DNS changes to become active, we recommend y 1. Use the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud) to run the script. - {{}} -To ensure the `gcloud` script configures the endpoints correctly, do not make any changes to it. - {{}} + > [!WARNING] + > To ensure the `gcloud` script configures the endpoints correctly, do not make any changes to it. + > The `gcloud` script creates a PSC endpoint and a DNS response policy in the consumer application VPC. @@ -134,9 +134,8 @@ Once your Private Service Connect endpoint is active, you can connect your appli 1. Copy the endpoint and use it in your application to connect to your database. -{{< note >}} -Once your Private Service Connect endpoint is active, you must connect to the database from the Private Service Connect endpoint if you want to connect with Private Service connect. If you previously used the public or private endpoint to connect to your database, you must migrate any connections to the Private Service Connect endpoint. -{{< /note >}} +> [!NOTE] +> Once your Private Service Connect endpoint is active, you must connect to the database from the Private Service Connect endpoint if you want to connect with Private Service connect. If you previously used the public or private endpoint to connect to your database, you must migrate any connections to the Private Service Connect endpoint. ## Deactivate Private Service Connect {#deactivate-psc} @@ -171,8 +170,8 @@ Once you remove all of your Private Service Connect endpoints and deactivate it, Private Service Connect has the following limitations in Redis Cloud: -- Although Redis Cloud supports using Private Service Connect with Enterprise clustering, you cannot use the [Cluster API]({{< relref "/operate/rc/databases/create-database#oss-cluster-api" >}}) with Private Service Connect enabled. -- The pre-handoff feature of [Smart client handoffs]({{< relref "/develop/clients/sch#redis-cloud" >}}) is not currently supported with Private Service Connect, but relaxed timeouts are available and enabled by default. +- Although Redis Cloud supports using Private Service Connect with Enterprise clustering, you cannot use the [Cluster API](/content/operate/rc/databases/create-database/_index.md#oss-cluster-api) with Private Service Connect enabled. +- The pre-handoff feature of [Smart client handoffs](/content/develop/clients/sch.md#redis-cloud) is not currently supported with Private Service Connect, but relaxed timeouts are available and enabled by default. ## Continue learning with Redis University diff --git a/content/operate/rc/security/vpc-peering.md b/content/operate/rc/security/vpc-peering.md index c6ddb72b43..e2aac4cced 100644 --- a/content/operate/rc/security/vpc-peering.md +++ b/content/operate/rc/security/vpc-peering.md @@ -15,9 +15,8 @@ VPC peering uses private IP addresses to allow network connections between two [ You can connect your VPC in the Redis Cloud subscription to the VPC of your application. This lets your application connect securely to your Redis Cloud database using VPC peering to optimize the performance of your application. -{{< note >}} -VPC peering is available only with Redis Cloud Pro. It is not supported for Redis Cloud Essentials. -{{< /note >}} +> [!NOTE] +> VPC peering is available only with Redis Cloud Pro. It is not supported for Redis Cloud Essentials. VPC peering configuration requires you to initiate VPC peering on your Redis Cloud subscription and then accept the VPC peering request for the AWS VPC that you want to peer with. @@ -86,9 +85,8 @@ To finish VPC peering setup, [update your route tables for the peering connectio Once VPC peering is established, we recommend switching your application connection string to the private endpoint. -{{< note >}} -{{< embed-md "rc-vpc-peering-cidr-list.md" >}} -{{< /note >}} +> [!NOTE] +> {{< embed-md "rc-vpc-peering-cidr-list.md" >}} ## Google Cloud VPC peering {#gcp-vpc-peering} @@ -124,9 +122,8 @@ To set up VPC peering: {{View VPC peering list.}} -{{< note >}} -Redis Cloud enables **Import custom routes** by default on its side of the peering connection. If you want Redis Cloud to import custom routes from your application VPC (for example, to reach Redis Cloud from other networks connected to your application VPC), you must also enable **Export custom routes** on your application VPC. Otherwise, custom routes from your application VPC aren't imported and you may experience connectivity issues. -{{< /note >}} +> [!NOTE] +> Redis Cloud enables **Import custom routes** by default on its side of the peering connection. If you want Redis Cloud to import custom routes from your application VPC (for example, to reach Redis Cloud from other networks connected to your application VPC), you must also enable **Export custom routes** on your application VPC. Otherwise, custom routes from your application VPC aren't imported and you may experience connectivity issues. ### Approve VPC peering request {#approve-gcp-vpc-peering} @@ -134,9 +131,8 @@ To approve the VPC peering request between Redis Cloud and Google Cloud, use the Once VPC peering is established, we recommend switching your application connection string to the private endpoint. -{{< note >}} -{{< embed-md "rc-vpc-peering-cidr-list.md" >}} -{{< /note >}} +> [!NOTE] +> {{< embed-md "rc-vpc-peering-cidr-list.md" >}} ## Continue learning with Redis University