Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 15 additions & 16 deletions content/operate/rc/security/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,40 +15,39 @@ Redis Cloud provides a number of ways to secure subscriptions and databases.
As a Redis Cloud user, consider these security domains:

- The [Redis Cloud console](#admin-console-security)
- [Your databases]({{< relref "/operate/rc/security/database-security/" >}})
- The [Redis Cloud API]({{< relref "/operate/rc/api/get-started/enable-the-api" >}})
- [Your databases](/content/operate/rc/security/database-security/_index.md)
- The [Redis Cloud API](/content/operate/rc/api/get-started/enable-the-api.md)

First, you might want to review our [shared responsibility model]({{< relref "/operate/rc/security/shared-responsibility-model" >}}) for security.
First, you might want to review our [shared responsibility model](/content/operate/rc/security/shared-responsibility-model.md) for security.

## Redis Cloud console security {#admin-console-security}

The Redis Cloud console is the web application you use to manage your Redis Cloud deployments.

Secure access to the Redis Cloud console by:

- Assigning appropriate roles to [team members with access]({{< relref "/operate/rc/security/access-control/access-management#team-management-roles" >}}).
- Assigning appropriate roles to [team members with access](/content/operate/rc/security/access-control/access-management.md#team-management-roles).

- Enabling [multi-factor authentication]({{< relref "/operate/rc/security/access-control/multi-factor-authentication" >}}).
- Enabling [multi-factor authentication](/content/operate/rc/security/access-control/multi-factor-authentication.md).

- Enabling [SAML SSO]({{< relref "/operate/rc/security/access-control/saml-sso" >}}).
- Enabling [SAML SSO](/content/operate/rc/security/access-control/saml-sso/_index.md).

{{< note >}}
A user session on Redis Cloud expires after 30 minutes. You'll be signed out of Redis Cloud after 30 minutes of inactivity.
{{< /note >}}
> [!NOTE]
> A user session on Redis Cloud expires after 30 minutes. You'll be signed out of Redis Cloud after 30 minutes of inactivity.

## Database security

You have several options when it comes to securing your Redis Cloud databases. For more information, see [Cloud database security]({{< relref "/operate/rc/security/database-security/" >}}). Options include:
You have several options when it comes to securing your Redis Cloud databases. For more information, see [Cloud database security](/content/operate/rc/security/database-security/_index.md). Options include:

- [Encryption at rest]({{< relref "/operate/rc/security/encryption-at-rest" >}})
- [Role-based access control]({{< relref "/operate/rc/security/access-control/data-access-control/role-based-access-control" >}})
- [TLS]({{< relref "/operate/rc/security/database-security/tls-ssl" >}})
- [Network security]({{< relref "/operate/rc/security/database-security/network-security" >}}) using
- [VPC peering]({{< relref "/operate/rc/security/vpc-peering" >}}) and [CIDR whitelist]({{< relref "/operate/rc/security/cidr-whitelist" >}})
- [Encryption at rest](/content/operate/rc/security/encryption-at-rest.md)
- [Role-based access control](/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md)
- [TLS](/content/operate/rc/security/database-security/tls-ssl.md)
- [Network security](/content/operate/rc/security/database-security/network-security.md) using
- [VPC peering](/content/operate/rc/security/vpc-peering.md) and [CIDR whitelist](/content/operate/rc/security/cidr-whitelist.md)

## API security

The Redis Cloud API allows you to programmatically administer your subscriptions and database deployments. This API is disabled by default. When you [enable the API]({{< relref "/operate/rc/api/get-started/enable-the-api" >}}), you can then [manage the API keys]({{< relref "/operate/rc/api/get-started/manage-api-keys" >}}) for all owners of your Redis Cloud account. For an overview of the security features of the API, see the [API authentication documentation]({{< relref "/operate/rc/api/get-started/" >}}).
The Redis Cloud API allows you to programmatically administer your subscriptions and database deployments. This API is disabled by default. When you [enable the API](/content/operate/rc/api/get-started/enable-the-api.md), you can then [manage the API keys](/content/operate/rc/api/get-started/manage-api-keys.md) for all owners of your Redis Cloud account. For an overview of the security features of the API, see the [API authentication documentation](/content/operate/rc/api/get-started/_index.md).

## Continue learning with Redis University

Expand Down
12 changes: 6 additions & 6 deletions content/operate/rc/security/access-control/access-management.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,11 @@ The **Access management** screen helps you manage:

- The team of users allowed to access your subscription and its databases.
- The API keys that authenticate application access to your account.
- [Single sign-on (SSO) with SAML]({{< relref "/operate/rc/security/access-control/saml-sso" >}}).
- [Single sign-on (SSO) with SAML](/content/operate/rc/security/access-control/saml-sso/_index.md).

Here, you learn how to manage your team's users and control their level of access.

For help managing API keys, see [Manage API keys]({{< relref "/operate/rc/api/get-started/manage-api-keys" >}}).
For help managing API keys, see [Manage API keys](/content/operate/rc/api/get-started/manage-api-keys.md).

## Manage team access

Expand Down Expand Up @@ -54,7 +54,7 @@ Use the dialog to specify these values.
| **Role** | The role identifies their subscription and account privileges. For details, see [Team management roles](#team-management-roles). |
| **Email** | The address used for alerts and other email messages regarding the account |
| **Alert emails** | Enable to be notified when subscription databases cross certain thresholds, such as exceeding memory limits or latency requirements |
| **Operational emails** | Notifications about subscription and database changes, such as creating or deleting a database, and [subscription and database maintenance]({{< relref "/operate/rc/subscriptions/maintenance" >}}) |
| **Operational emails** | Notifications about subscription and database changes, such as creating or deleting a database, and [subscription and database maintenance](/content/operate/rc/subscriptions/maintenance/_index.md) |
| **Billing emails** | Notifications about billing, such as when bills are issued and paid |
| **Multi-factor authentication** | Whether MFA is enabled for the member. This is deactivated when members have not enabled or confirmed MFA in their user profile settings. |

Expand Down Expand Up @@ -107,7 +107,7 @@ Roles and responsibilities are:

- **Viewer** can view all databases and their configurations, including database secrets.

- **Logs viewer** can not access the Redis Cloud console. They are only allowed access to the [Redis Cloud API]({{< relref "/operate/rc/api" >}}) [`GET logs/`]({{< relref "/operate/rc/api/api-reference#tag/Account/operation/getAccountSystemLogs" >}}) endpoint.
- **Logs viewer** can not access the Redis Cloud console. They are only allowed access to the [Redis Cloud API](/content/operate/rc/api/_index.md) [`GET logs/`](/content/operate/rc/api/api-reference.md#tag/Account/operation/getAccountSystemLogs) endpoint.

This table shows each role's ability to perform common tasks.

Expand All @@ -124,7 +124,7 @@ This table shows each role's ability to perform common tasks.
| Edit database (no cost impact) | <span title="Owners can edit databases in ways that do not impact costs"><nobr>&#x2705; Yes</nobr></span> | <span title="Billing Admins may not change databases in ways that do not affect costs"><nobr>&#x274c; No</nobr></span> | <span title="Managers can change databases in ways that do not affect costs"><nobr>&#x2705; Yes</nobr></span> | <span title="Members can change databases in ways that do not affect costs"><nobr>&#x2705; Yes</nobr></span> | <span title="Viewers may not change databases in ways that do not affect costs"><nobr>&#x274c; No</nobr></span> | <span title="Logs viewers may not change databases in ways that do not affect costs"><nobr>&#x274c; No</nobr></span> |
| View subscription | <span title="Owners can view subscription details"><nobr>&#x2705; Yes</nobr></span> | <span title="Billing Admins can view subscription details"><nobr>&#x2705; Yes</nobr></span> | <span title="Managers can view subscription details"><nobr>&#x2705; Yes</nobr></span> | <span title="Members can view subscription details"><nobr>&#x2705; Yes</nobr></span> | <span title="Viewers can view subscription details"><nobr>&#x2705; Yes</nobr></span> | <span title="Logs viewers may not view subscriptions"><nobr>&#x274c; No</nobr></span> |
| View database | <span title="Owners can view database details"><nobr>&#x2705; Yes</nobr></span> | <span title="Billing Admins can view the list of databases but not database details"><nobr>&#x2705; Yes<sup>[4](#table-note-4)</sup></nobr></span> | <span title="Managers can view database details"><nobr>&#x2705; Yes</nobr></span> | <span title="Members can view database details"><nobr>&#x2705; Yes</nobr></span> | <span title="Viewers can view database details"><nobr>&#x2705; Yes</nobr></span> | <span title="Logs viewers may not view databases"><nobr>&#x274c; No</nobr></span> |
| Use the [REST API]({{< relref "/operate/rc/api" >}}) | <span title="Owners can use the Redis Cloud API"><nobr>&#x2705; Yes</nobr></span> | <span title="Billing Admins can use the Redis Cloud REST API for billing data"><nobr>&#x2705; Yes<sup>[5](#table-note-5)</sup></nobr></span> | <span title="Managers may not use the REST API"><nobr>&#x274c; No</nobr></span> | <span title="Members may not use the REST API"><nobr>&#x274c; No</nobr></span> | <span title="Viewers can use the REST API for GET requests only"><nobr>&#x2705; Yes<sup>[6](#table-note-6)</sup></nobr></span> | <span title="Logs viewers can use the REST API for GET /logs only"><nobr>&#x2705; Yes<sup>[7](#table-note-7)</sup></nobr></span> |
| Use the [REST API](/content/operate/rc/api/_index.md) | <span title="Owners can use the Redis Cloud API"><nobr>&#x2705; Yes</nobr></span> | <span title="Billing Admins can use the Redis Cloud REST API for billing data"><nobr>&#x2705; Yes<sup>[5](#table-note-5)</sup></nobr></span> | <span title="Managers may not use the REST API"><nobr>&#x274c; No</nobr></span> | <span title="Members may not use the REST API"><nobr>&#x274c; No</nobr></span> | <span title="Viewers can use the REST API for GET requests only"><nobr>&#x2705; Yes<sup>[6](#table-note-6)</sup></nobr></span> | <span title="Logs viewers can use the REST API for GET /logs only"><nobr>&#x2705; Yes<sup>[7](#table-note-7)</sup></nobr></span> |

1. <a name="table-note-1" style="display: block; height: 80px; margin-top: -80px;"></a>Billing Admins can only edit the account billing address in Account Settings.

Expand All @@ -138,4 +138,4 @@ This table shows each role's ability to perform common tasks.

6. <a name="table-note-6" style="display: block; height: 80px; margin-top: -80px;"></a>Viewers can use the REST API for GET requests, but cannot modify subscription or database details.

7. <a name="table-note-7" style="display: block; height: 80px; margin-top: -80px;"></a>Logs viewers can only use the [`GET logs/`]({{< relref "/operate/rc/api/api-reference#tag/Account/operation/getAccountSystemLogs" >}}) endpoint of the REST API.
7. <a name="table-note-7" style="display: block; height: 80px; margin-top: -80px;"></a>Logs viewers can only use the [`GET logs/`](/content/operate/rc/api/api-reference.md#tag/Account/operation/getAccountSystemLogs) endpoint of the REST API.
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,14 @@ weight: 25

## Default user

When you create a Redis Cloud database, your database is given a randomly generated password called the [**Default user password**]({{< relref "/operate/rc/security/access-control/data-access-control/default-user" >}}). Learn how to [change the default user password]({{< relref "/operate/rc/security/access-control/data-access-control/default-user#change-password" >}}) or [turn off default user access]({{< relref "/operate/rc/security/access-control/data-access-control/default-user#turn-off-default-user" >}}).
When you create a Redis Cloud database, your database is given a randomly generated password called the [**Default user password**](/content/operate/rc/security/access-control/data-access-control/default-user.md). Learn how to [change the default user password](/content/operate/rc/security/access-control/data-access-control/default-user.md#change-password) or [turn off default user access](/content/operate/rc/security/access-control/data-access-control/default-user.md#turn-off-default-user).

## Role-based access control

With [role-based access control (RBAC)]({{< relref "/operate/rc/security/access-control/data-access-control/role-based-access-control.md" >}}), you create roles and assign users to those roles to grant different levels of access to the database.
With [role-based access control (RBAC)](/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md), you create roles and assign users to those roles to grant different levels of access to the database.

- [Enable RBAC]({{< relref "/operate/rc/security/access-control/data-access-control/role-based-access-control" >}})
- [Configure ACLs]({{< relref "/operate/rc/security/access-control/data-access-control/configure-acls" >}})
- [Create roles]({{< relref "/operate/rc/security/access-control/data-access-control/create-roles" >}})
- [Create and edit database users]({{< relref "/operate/rc/security/access-control/data-access-control/create-assign-users" >}})
- [Active-Active roles]({{< relref "/operate/rc/security/access-control/data-access-control/active-active-roles" >}})
- [Enable RBAC](/content/operate/rc/security/access-control/data-access-control/role-based-access-control.md)
- [Configure ACLs](/content/operate/rc/security/access-control/data-access-control/configure-acls.md)
- [Create roles](/content/operate/rc/security/access-control/data-access-control/create-roles.md)
- [Create and edit database users](/content/operate/rc/security/access-control/data-access-control/create-assign-users.md)
- [Active-Active roles](/content/operate/rc/security/access-control/data-access-control/active-active-roles.md)
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ toc: 'true'
weight: $weight
---

For [Active-Active databases]({{< relref "/operate/rc/databases/active-active" >}}), you can define roles with different levels of access for different regions. For example, you can define a user role with full database access in one region and read-only access in another. Or, you can prevent a user from running any commands in a specified region.
For [Active-Active databases](/content/operate/rc/databases/active-active/_index.md), you can define roles with different levels of access for different regions. For example, you can define a user role with full database access in one region and read-only access in another. Or, you can prevent a user from running any commands in a specified region.

1. Go to **Data Access Control > Roles** and either select `+` to create a new role or point to an existing role and select the pencil icon to edit it.

Expand All @@ -26,9 +26,9 @@ For [Active-Active databases]({{< relref "/operate/rc/databases/active-active" >

1. To set the role's default level of access to the selected databases, choose a **Redis ACL** from the list and select the check mark to confirm the association.

{{< note >}}
The default level of access to the selected database only applies to regions that exist when the role is created. If you add a new region to your Active-Active subscription, the new region will default to **No Access** for the role.
{{< /note >}}
> [!NOTE]
> The default level of access to the selected database only applies to regions that exist when the role is created. If you add a new region to your Active-Active subscription, the new region will default to **No Access** for the role.
>

1. Select the ACL name next to a region to change which ACL applies to that region.

Expand All @@ -38,10 +38,9 @@ The default level of access to the selected database only applies to regions tha

1. Select **Save role**.

When you assign a user-defined ACL rule to a role and associate it with one or more databases, Redis will verify that the ACL rule will work with the selected databases. Verify that the [syntax]({{< relref "/operate/rc/security/access-control/data-access-control/configure-acls#define-permissions-with-acl-syntax" >}}) of the ACL rule is correct if you receive an error.
When you assign a user-defined ACL rule to a role and associate it with one or more databases, Redis will verify that the ACL rule will work with the selected databases. Verify that the [syntax](/content/operate/rc/security/access-control/data-access-control/configure-acls.md#define-permissions-with-acl-syntax) of the ACL rule is correct if you receive an error.

After you create a role, you can assign it to a user. Users with this role can access the databases according to the role's associated Redis ACLs. For more information, see [Assign roles to users]({{< relref "/operate/rc/security/access-control/data-access-control/create-assign-users#assign-roles-to-existing-users" >}}).
After you create a role, you can assign it to a user. Users with this role can access the databases according to the role's associated Redis ACLs. For more information, see [Assign roles to users](/content/operate/rc/security/access-control/data-access-control/create-assign-users.md#assign-roles-to-existing-users).

{{< note >}}
{{< embed-md "rc-acls-note.md" >}}
{{< /note >}}
> [!NOTE]
> {{< embed-md "rc-acls-note.md" >}}
Loading
Loading