[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for Valkey™](../index.md) > [Step-by-step guides](index.md) > Users > Creating a user

# Creating a user

Yandex Managed Service for Valkey™ can create Valkey™ users and configure their permissions for commands, keys, and Pub/Sub channels in the cluster using [Valkey™ access control lists](https://valkey.io/topics/acl) (ACLs).

Valkey™ ACLs address two primary objectives:

* Ensure security by enforcing fine-grained access to commands and keys.
* Prevent accidental errors caused by user actions or software failures.

Creating a cluster automatically creates a `default` user. This user can access all keys and Pub/Sub channels in the cluster and can run all commands except administrative ones. You can view the user’s detailed permissions in the [user info](user-list.md#get).

## Creating a user {#create-user}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder containing the cluster.
  1. [Navigate to](../../console/operations/select-service.md#select-service) **Yandex Managed Service for Valkey™**.
  1. Click the name of your cluster and select the ![image](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Click **Create user** in the top-right corner of the page.
  
  
  1. Choose the authorization method:
      
      * **Password**: Authorization by username and password. For this authorization method:
        
        1. Enter the username.

        
        1. Set a user password in one of the following ways:
 
            * **Enter manually**: Enter the password manually. It must be from 8 to 128 characters long.
            * **Generate**: Generate a password using [Yandex Connection Manager](../../metadata-hub/concepts/connection-manager.md) and save it in a [Yandex Lockbox secret](../../lockbox/concepts/secret.md).

              To view the password, navigate to the cluster page, select the **Users** tab, and click **View password** for the relevant user. This will open the page of the Yandex Lockbox secret containing the password.

              To view passwords, you need the [lockbox.payloadViewer](../../lockbox/security/index.md#lockbox-payloadViewer) role.
        

      * **IAM**: Authorization via [accounts in Yandex Cloud](../../iam/concepts/users/accounts.md).
        
        For this authorization method, select the account in the **User** field.


  1. Select the **Enable user** option so that the user can connect to the cluster and execute commands.
  1. Under `Permissions`, specify user permissions:

      * `Patterns`: Permissions for key patterns.
      * `Pub Sub Channels`: Permissions for Pub/Sub channels.
      * `Categories`: Permissions for command categories.
      * `Commands`: Permissions for commands.
      * `Sanitize Payload`: Permission for data cleanup. The possible values are:
        
        * `sanitize-payload`: Data cleanup is enabled. This is the default value.
        * `skip-sanitize-payload`: Data cleanup is disabled.
        
      {% note info %}
      
      The user cannot get permissions for administrative commands of the `+@admin` category and [certain commands](../concepts/supported-features.md).
      
      {% endnote %}

      For more information about access control lists, see [this Valkey™ ACL guide](https://valkey.io/topics/acl).
  
  1. Click **Create**.

- CLI {#cli}
  
  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To create a Valkey™ user:

  1. See the description of the CLI command for creating a user:

      ```bash
      yc managed-redis user create --help
      ```
  
  1. Run this command to create a user (our example lists only some flags):

      ```bash
      yc managed-redis user create <username> \
        --cluster-id=<cluster_ID> \
        --password="<user_password>" \
        --disabled \
        --raw="<permissions>" \
        --categories="<permissions_for_command_categories>" \
        --commands="<permissions_for_commands>" \
        --patterns="<permissions_for_key_patterns>" \
        --pub-sub-channels="<permissions_for_channels>" \
        --sanitize-payload=<data_cleanup>
      ```

      Where:
      
      * `--cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      * `--password`: User password. It must be from 8 to 128 characters long.
      
      * `--disabled`: Disables the user. The default value is `false`.
      
      * `--raw`: String of space-separated permissions. Also, the string must set the user status:
        
        * `on`: User is enabled.
        * `off`: User is disabled.
        
        Example: `on ~data:* &* +@set +@hash +get +set`.

        {% note info %}

        The `--raw` flag cannot be used with separate permission flags or with `--disabled`.

        {% endnote %}
      
      * `--categories`: String of space-separated permissions for command categories.
      
      * `--commands`: String of space-separated permissions for commands.
      
      * `--patterns`: String of space-separated permissions for key patterns.
      
      * `--pub-sub-channels`: String of space-separated permissions for Pub/Sub channels.
      
      * `--sanitize-payload`: Data cleanup. The possible values are:
        
        * `sanitize-payload`: Data cleanup is enabled. This is the default value.
        * `skip-sanitize-payload`: Data cleanup is disabled.

      {% note info %}
      
      The user cannot get permissions for administrative commands of the `+@admin` category and [certain commands](../concepts/supported-features.md).
      
      {% endnote %}

      For more information about access control lists, see [this Valkey™ ACL guide](https://valkey.io/topics/acl).

- Terraform {#tf}

  1. Open the current Terraform configuration file with the infrastructure plan.
  
      For information on how to create this file, see [Creating a cluster](cluster-create.md).
  
  1. To create a user, add the `yandex_mdb_redis_user` resource:
  
      ```hcl
      resource "yandex_mdb_redis_user" "<local_resource_name>" {
        cluster_id = <cluster_ID>
        name       = "<username>"
        passwords  = ["<user_password>"]
        enabled    = <user_status>
        
        permissions = {
          categories       = "<permissions_for_command_categories>"
          commands         = "<permissions_for_commands>"
          patterns         = "<permissions_for_key_patterns>"
          pub_sub_channels = "<permissions_for_channels>"
          sanitize_payload = "<data_cleanup>"
        }
      }
      ```

      Where:

      * `cluster_id`: Cluster ID.
      
      * `name`: Username.
        
      * `passwords`: Password. It must be from 8 to 128 characters long.
          
        You can specify only one password.

      * `enabled`: User status. The possible values are:
        
        * `true`: User is enabled.
        * `false`: User is disabled.
      
      * `permissions`: User permission settings:

        * `categories`: String of space-separated permissions for command categories.
        
        * `commands`: String of space-separated permissions for commands.
        
        * `patterns`: String of space-separated permissions for key patterns.
          
        * `pub_sub_channels`: String of space-separated permissions for Pub/Sub channels.
          
        * `sanitize_payload`: Data cleanup. The possible values are:
          
          * `sanitize-payload`: Data cleanup is enabled. This is the default value.
          * `skip-sanitize-payload`: Data cleanup is disabled.
        
        {% note info %}
        
        The user cannot get permissions for administrative commands of the `+@admin` category and [certain commands](../concepts/supported-features.md).
        
        {% endnote %}

        For more information about access control lists, see [this Valkey™ ACL guide](https://valkey.io/topics/acl).
  
  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm updating the resources.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  1. Make sure the user is created by running this [CLI](../../cli/quickstart.md#install) command:
      
      ```bash
      yc managed-redis user get <username> \
        --cluster-id=<cluster_ID>
      ```

      Learn more on how to get information about a user [here](user-list.md#get).
  
  {% note warning "Timeouts" %}
  
  The Terraform provider sets the following timeouts for Yandex Managed Service for Valkey™ cluster operations:
  
  * Creating a cluster, including by restoring it from a backup: 15 minutes.
  * Editing a cluster: 60 minutes.
  * Deleting a cluster: 15 minutes.
  
  Operations exceeding the timeout are aborted.
  
  {% cut "How do I change these limits?" %}
  
  Add the `timeouts` section to your cluster description, such as the following:
  
  ```hcl
  resource "yandex_mdb_redis_cluster_v2" "<cluster_name>" {
    ...
    timeouts = {
      create = "1h30m" # 1 hour 30 minutes
      update = "2h"    # 2 hours
      delete = "30m"   # 30 minutes
    }
  }
  ```
  
  {% endcut %}
  
  {% endnote %}

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
        "userSpec": {
          "name": "<username>",
          "passwords": [
            "<user_password>"
          ],
          "permissions": {
            "patterns": "<permissions_for_key_patterns>",
            "pubSubChannels": "<permissions_for_channels>",
            "categories": "<permissions_for_command_categories>",
            "commands": "<permissions_for_commands>",
            "sanitizePayload": "<data_cleanup>"
          },
          "enabled": <user_status>
        }
      }
      ```

      Where `userSpec` stands for the user settings:
      
      * `name`: Username.

      * `passwords`: Password. It must be from 8 to 128 characters long.
      
        You can specify only one password.
      
      * `permissions`: User permission settings:

        * `patterns`: String of space-separated permissions for key patterns.
        * `pubSubChannels`: String of space-separated permissions for Pub/Sub channels.
        * `categories`: String of space-separated permissions for command categories.
        * `commands`: String of space-separated permissions for commands.
        * `sanitizePayload`: Data cleanup. The possible values are:
          
          * `sanitize-payload`: Data cleanup is enabled. This is the default value.
          * `skip-sanitize-payload`: Data cleanup is disabled.
        
        {% note info %}
        
        The user cannot get permissions for administrative commands of the `+@admin` category and [certain commands](../concepts/supported-features.md).
        
        {% endnote %}

        For more information about access control lists, see [this Valkey™ ACL guide](https://valkey.io/topics/acl). 

      * `enabled`: User status. The possible values are:
        
        * `true`: User is enabled.
        * `false`: User is disabled. 

  1. Call the [User.Create](../api-ref/User/create.md) method, e.g., via the following [cURL](https://curl.se/) request:

      ```bash
      curl \
        --request POST \
        --header "Authorization: Bearer $IAM_TOKEN" \
        --header "Content-Type: application/json" \
        --url 'https://mdb.api.cloud.yandex.net/managed-redis/v1/clusters/<cluster_ID>/users' \
        --data "@body.json"
      ```

      You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

  1. Check the [server response](../api-ref/User/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.

  1. Create a file named `body.json` and paste the following code into it:
      
      ```json
      {
        "cluster_id": "<cluster_ID>",
        "user_spec": {
          "name": "<username>",
          "passwords": [
            "<user_password>"
          ],
          "permissions": {
            "patterns": "<permissions_for_key_patterns>",
            "pub_sub_channels": "<permissions_for_channels>",
            "categories": "<permissions_for_command_categories>",
            "commands": "<permissions_for_commands>",
            "sanitize_payload": "<data_cleanup>"
          },
          "enabled": <user_status>
        }
      }
      ```

      Where:

      * `cluster_id`: Cluster ID.
      
        You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      * `user_spec`: User settings:
      
        * `name`: Username.
        
        * `passwords`: Password. It must be from 8 to 128 characters long.
          
          You can specify only one password.
      
        * `permissions`: User permission settings:

          * `patterns`: String of space-separated permissions for key patterns.
          
          * `pub_sub_channels`: String of space-separated permissions for Pub/Sub channels.
          
          * `categories`: String of space-separated permissions for command categories.
          
          * `commands`: String of space-separated permissions for commands.
          
          * `sanitize_payload`: Data cleanup. The possible values are:
          
            * `sanitize-payload`: Data cleanup is enabled. This is the default value.
            * `skip-sanitize-payload`: Data cleanup is disabled.
        
          {% note info %}
          
          The user cannot get permissions for administrative commands of the `+@admin` category and [certain commands](../concepts/supported-features.md).
          
          {% endnote %}

          For more information about access control lists, see [this Valkey™ ACL guide](https://valkey.io/topics/acl).

        * `enabled`: User status. The possible values are:
        
          * `true`: User is enabled.
          * `false`: User is disabled.

  1. Call the [UserService.Create](../api-ref/grpc/User/create.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

      ```bash
      grpcurl \
        -format json \
        -import-path ~/cloudapi/ \
        -import-path ~/cloudapi/third_party/googleapis/ \
        -proto ~/cloudapi/yandex/cloud/mdb/redis/v1/user_service.proto \
        -rpc-header "Authorization: Bearer $IAM_TOKEN" \
        -d @ \
        mdb.api.cloud.yandex.net:443 \
        yandex.cloud.mdb.redis.v1.UserService.Create \
        < body.json
        ```

  1. Check the [server response](../api-ref/grpc/User/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}