We have a lot of services that use redis, and we are securing our new sharded cluster redis by creating a specific user for each service. What are the redis commands to disable for each user to secure our cluster? Our services have a normal usage of redis (read and write keys, pub/sub channels, some healthchecks, etc.), no one needs admin or dangerous commands. Is the following ACL sufficient to secure our redis?
user foo reset on>password resetkeys ~{bar:baz}:baz:* resetchannels ${bar:baz}:baz:* +@all -@admin -@dangerous
The aim is to basically secure our cluster, as do not allow a user to modify keys/channels of another, or do not allow a user to perform cluster/instance action, administration tasks, etc. Finally, all our services use https://github.com/StackExchange/StackExchange.Redis and https://www.npmjs.com/package/bull (with the connector https://github.com/luin/ioredis) clients.