[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for Valkey™](../index.md) > [Step-by-step guides](index.md) > Users > Updating user settings

# Updating user settings

After creating a Valkey™ user, you can:

* [Change the password](#change-password).
* [Change the user status](#change-status).
* [Configure data cleanup](#change-sanitize-payload).
* [Assign user permissions](#change-permissions).

## Changing a user password {#change-password}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder containing the cluster.
  1. [Navigate to](../../console/operations/select-service.md#select-service) **Yandex Managed Service for Valkey™**.
  1. Click the name of your cluster and select the ![image](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Locate the user you need in the list, click ![image](../../_assets/console-icons/ellipsis.svg) in their row, and select **Change password**.
  
    
  1. Set a user password in one of the following ways:

      * **Enter manually**: Enter a password manually. It must be from 8 to 128 characters long.
      * **Generate**: Generate a password using [Yandex Connection Manager](../../metadata-hub/concepts/connection-manager.md) and store it in a [Yandex Lockbox secret](../../lockbox/concepts/secret.md).

        To view the password, navigate to the cluster page, select the **Users** tab, and click **View password** for the relevant user. This will open the page of the Yandex Lockbox secret containing the password.

        To view passwords, you need the [lockbox.payloadViewer](../../lockbox/security/index.md#lockbox-payloadViewer) role.


  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To change a Valkey™ user password:

  1. View the description of the CLI command for updating user settings:

      ```bash
      yc managed-redis user update --help
      ```

  1. Change the password by running this command:

      ```bash
      yc managed-redis user update <username> \
        --cluster-id=<cluster_ID> \
        --password="<user_password>" 
      ```

      Where:

      * `--cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      * `--password`: User password. It must be from 8 to 128 characters long.

      You can get the username with the [list of users](user-list.md#list) in the cluster.

- Terraform {#tf}

  1. Open the current Terraform configuration file with the infrastructure plan.

      For information on how to create this file, see [Creating a cluster](cluster-create.md).

  1. Update the `passwords` argument in the `yandex_mdb_redis_user` resource description:

      ```hcl
      resource "yandex_mdb_redis_user" "<local_resource_name>" {
        ...
        passwords = [ "<user_password>" ]
      }
      ```

      Where `passwords` is the user password. It must be from 8 to 128 characters long.

      You can specify only one password.

  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm updating the resources.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  {% note warning "Timeouts" %}
  
  The Terraform provider sets the following timeouts for Yandex Managed Service for Valkey™ cluster operations:
  
  * Creating a cluster, including by restoring it from a backup: 15 minutes.
  * Editing a cluster: 60 minutes.
  * Deleting a cluster: 15 minutes.
  
  Operations exceeding the timeout are aborted.
  
  {% cut "How do I change these limits?" %}
  
  Add the `timeouts` section to your cluster description, such as the following:
  
  ```hcl
  resource "yandex_mdb_redis_cluster_v2" "<cluster_name>" {
    ...
    timeouts = {
      create = "1h30m" # 1 hour 30 minutes
      update = "2h"    # 2 hours
      delete = "30m"   # 30 minutes
    }
  }
  ```
  
  {% endcut %}
  
  {% endnote %}

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
        "updateMask": "passwords",
        "passwords": [
          "<user_password>"
        ]
      }
      ```

      Where:

      * `updateMask`: Comma-separated string of settings you want to update.

        {% note warning %}
        
        When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the `updateMask` parameter.
        
        {% endnote %}

      * `passwords`: User password. It must be from 8 to 128 characters long.

        You can specify only one password.

  1. Call the [User.Update](../api-ref/User/update.md) method, e.g., via the following [cURL](https://curl.se/) request:

      ```bash
      curl \
        --request PATCH \
        --header "Authorization: Bearer $IAM_TOKEN" \
        --header "Content-Type: application/json" \
        --url 'https://mdb.api.cloud.yandex.net/managed-redis/v1/clusters/<cluster_ID>/users/<username>' \
        --data "@body.json"
      ```

      You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      You can get the username with the [list of users](user-list.md#list) in the cluster.

  1. Check the [server response](../api-ref/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.

  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
        "cluster_id": "<cluster_ID>",
        "user_name": "<username>",
        "update_mask": {
          "paths": [
            "passwords"
          ]
        },
        "passwords": [
          "<user_password>"
        ]
      }
      ```

      Where:

      * `cluster_id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      * `user_name`: Username.

        You can get the username with the [list of users](user-list.md#list) in the cluster.

      * `update_mask`: List of settings to update as an array of strings (`paths[]`).

        {% cut "Format for listing settings" %}

          ```yaml
          "update_mask": {
            "paths": [
              "<setting_1>",
              "<setting_2>",
              ...
              "<setting_N>"
            ]
          }
          ```

        {% endcut %}

        {% note warning %}
        
        When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the `update_mask` parameter.
        
        {% endnote %}

      * `passwords`: Password. It must be from 8 to 128 characters long.

        You can specify only one password.  

  1. Call the [UserService.Update](../api-ref/grpc/User/update.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

      ```bash
      grpcurl \
        -format json \
        -import-path ~/cloudapi/ \
        -import-path ~/cloudapi/third_party/googleapis/ \
        -proto ~/cloudapi/yandex/cloud/mdb/redis/v1/user_service.proto \
        -rpc-header "Authorization: Bearer $IAM_TOKEN" \
        -d @ \
        mdb.api.cloud.yandex.net:443 \
        yandex.cloud.mdb.redis.v1.UserService.Update \
        < body.json
        ```

  1. Check the [server response](../api-ref/grpc/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Changing a user status {#change-status}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder containing the cluster.
  1. [Navigate to](../../console/operations/select-service.md#select-service) **Yandex Managed Service for&nbsp;Valkey™**.
  1. Click the name of your cluster and select the ![image](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Locate the user you need in the list, click ![image](../../_assets/console-icons/ellipsis.svg) in their row, and select **Configure**.
  1. Change the user status with the **Enable user** option:
      
      * Enable the option to allow the user to connect to the cluster and run commands.
      * Disable the option to prevent the user from connecting to the cluster.

  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To change a Valkey™ user status:

  1. View the description of the CLI command for updating user settings:

      ```bash
      yc managed-redis user update --help
      ```

  1. Change the user status by running this command:

      ```bash
      yc managed-redis user update <username> \
        --cluster-id=<cluster_ID> \
        <user_status> 
      ```

      Where:

      * `--cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      * Specify one of these user status flags:

        * `--disabled`: User is disabled.
        * `--enabled`: User is enabled.

      You can get the username with the [list of users](user-list.md#list) in the cluster.

- Terraform {#tf}

  1. Open the current Terraform configuration file with the infrastructure plan.

      For information on how to create this file, see [Creating a cluster](cluster-create.md).

  1. Update the `enabled` argument in the `yandex_mdb_redis_user` resource description:

      ```hcl
      resource "yandex_mdb_redis_user" "<local_resource_name>" {
        ...
        enabled = <user_status>
      }
      ```

      Where `enabled` is the user status. The possible values are:

      * `true`: User is enabled.
      * `false`: User is disabled.

  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm updating the resources.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  {% note warning "Timeouts" %}
  
  The Terraform provider sets the following timeouts for Yandex Managed Service for Valkey™ cluster operations:
  
  * Creating a cluster, including by restoring it from a backup: 15 minutes.
  * Editing a cluster: 60 minutes.
  * Deleting a cluster: 15 minutes.
  
  Operations exceeding the timeout are aborted.
  
  {% cut "How do I change these limits?" %}
  
  Add the `timeouts` section to your cluster description, such as the following:
  
  ```hcl
  resource "yandex_mdb_redis_cluster_v2" "<cluster_name>" {
    ...
    timeouts = {
      create = "1h30m" # 1 hour 30 minutes
      update = "2h"    # 2 hours
      delete = "30m"   # 30 minutes
    }
  }
  ```
  
  {% endcut %}
  
  {% endnote %}

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
        "updateMask": "enabled",
        "enabled": <user_status>
      }
      ```

      Where:

      * `updateMask`: Comma-separated string of settings to update.

        {% note warning %}
        
        When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the `updateMask` parameter.
        
        {% endnote %}

      * `enabled`: User status. The possible values are:

        * `true`: User is enabled.
        * `false`: User is disabled.

  1. Call the [User.Update](../api-ref/User/update.md) method, e.g., via the following [cURL](https://curl.se/) request:

      ```bash
      curl \
        --request PATCH \
        --header "Authorization: Bearer $IAM_TOKEN" \
        --header "Content-Type: application/json" \
        --url 'https://mdb.api.cloud.yandex.net/managed-redis/v1/clusters/<cluster_ID>/users/<username>' \
        --data "@body.json"
      ```

      You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      You can get the username with the [list of users](user-list.md#list) in the cluster.

  1. Check the [server response](../api-ref/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.

  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
        "cluster_id": "<cluster_ID>",
        "user_name": "<username>",
        "update_mask": {
          "paths": [
            "enabled"
          ]
        },
        "enabled": <user_status>
      }
      ```

      Where:

      * `cluster_id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      * `user_name`: Username.

        You can get the username with the [list of users](user-list.md#list) in the cluster.

      * `update_mask`: List of settings to update as an array of strings (`paths[]`).

        {% cut "Format for listing settings" %}

          ```yaml
          "update_mask": {
            "paths": [
              "<setting_1>",
              "<setting_2>",
              ...
              "<setting_N>"
            ]
          }
          ```

        {% endcut %}

        {% note warning %}
        
        When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the `update_mask` parameter.
        
        {% endnote %}

      * `enabled`: User status. The possible values are:

          * `true`: User is enabled.
          * `false`: User is disabled.

  1. Call the [UserService.Update](../api-ref/grpc/User/update.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

      ```bash
      grpcurl \
        -format json \
        -import-path ~/cloudapi/ \
        -import-path ~/cloudapi/third_party/googleapis/ \
        -proto ~/cloudapi/yandex/cloud/mdb/redis/v1/user_service.proto \
        -rpc-header "Authorization: Bearer $IAM_TOKEN" \
        -d @ \
        mdb.api.cloud.yandex.net:443 \
        yandex.cloud.mdb.redis.v1.UserService.Update \
        < body.json
        ```

  1. Check the [server response](../api-ref/grpc/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Configuring data cleanup {#change-sanitize-payload}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder containing the cluster.
  1. [Navigate to](../../console/operations/select-service.md#select-service) **Yandex Managed Service for&nbsp;Valkey™**.
  1. Click the name of your cluster and select the ![image](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Locate the user you need in the list, click ![image](../../_assets/console-icons/ellipsis.svg) in their row, and select **Configure**.
  1. Under `Permissions`, in the `Sanitize Payload` field, specify the user permission to clean up data. The possible values are:
        
      * `sanitize-payload`: Data cleanup is enabled. This is the default value.
      * `skip-sanitize-payload`: Data cleanup is disabled.
  
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To configure data cleanup:

  1. View the description of the CLI command for updating user settings:

      ```bash
      yc managed-redis user update --help
      ```

  1. Configure data cleanup by running this command:

      ```bash
      yc managed-redis user update <username> \
        --cluster-id=<cluster_ID> \
        --sanitize-payload=<data_cleanup> 
      ```

      Where:

      * `--cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      * `--sanitize-payload`: Data cleanup. The possible values are:

        * `sanitize-payload`: Data cleanup is enabled. This is the default value.
        * `skip-sanitize-payload`: Data cleanup is disabled.

      You can get the username with the [list of users](user-list.md#list) in the cluster.

- Terraform {#tf}

  1. Open the current Terraform configuration file with the infrastructure plan.

      For information on how to create this file, see [Creating a cluster](cluster-create.md).

  1. Update the `sanitize_payload` argument in the `yandex_mdb_redis_user` resource description:

      ```hcl
      resource "yandex_mdb_redis_user" "<local_resource_name>" {
        ...
        sanitize_payload = "<data_cleanup>"
      }
      ```

      Where `--sanitize-payload` stands for data cleanup. The possible values are:

      * `sanitize-payload`: Data cleanup is enabled. This is the default value.
      * `skip-sanitize-payload`: Data cleanup is disabled.

  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm updating the resources.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  {% note warning "Timeouts" %}
  
  The Terraform provider sets the following timeouts for Yandex Managed Service for Valkey™ cluster operations:
  
  * Creating a cluster, including by restoring it from a backup: 15 minutes.
  * Editing a cluster: 60 minutes.
  * Deleting a cluster: 15 minutes.
  
  Operations exceeding the timeout are aborted.
  
  {% cut "How do I change these limits?" %}
  
  Add the `timeouts` section to your cluster description, such as the following:
  
  ```hcl
  resource "yandex_mdb_redis_cluster_v2" "<cluster_name>" {
    ...
    timeouts = {
      create = "1h30m" # 1 hour 30 minutes
      update = "2h"    # 2 hours
      delete = "30m"   # 30 minutes
    }
  }
  ```
  
  {% endcut %}
  
  {% endnote %}

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
        "updateMask": "permissions.sanitizePayload",
        "permissions": {
          "sanitizePayload": "<data_cleanup>"
        }
      }
      ```

      Where:

      * `updateMask`: Comma-separated string of settings to update.

        {% note warning %}
        
        When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the `updateMask` parameter.
        
        {% endnote %}

      * `permissions.sanitizePayload`: Data cleanup. The possible values are:

        * `sanitize-payload`: Data cleanup is enabled. This is the default value.
        * `skip-sanitize-payload`: Data cleanup is disabled.

  1. Call the [User.Update](../api-ref/User/update.md) method, e.g., via the following [cURL](https://curl.se/) request:

      ```bash
      curl \
        --request PATCH \
        --header "Authorization: Bearer $IAM_TOKEN" \
        --header "Content-Type: application/json" \
        --url 'https://mdb.api.cloud.yandex.net/managed-redis/v1/clusters/<cluster_ID>/users/<username>' \
        --data "@body.json"
      ```

      You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      You can get the username with the [list of users](user-list.md#list) in the cluster.

  1. Check the [server response](../api-ref/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.

  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
        "cluster_id": "<cluster_ID>",
        "user_name": "<username>",
        "update_mask": {
          "paths": [
            "permissions.sanitize_payload"
          ]
        },
        "permissions": {
          "sanitize_payload": "<data_cleanup>"
        }
      }
      ```

      Where:

      * `cluster_id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      * `user_name`: Username.

        You can get the username with the [list of users](user-list.md#list) in the cluster.

      * `update_mask`: List of parameters to update as an array of strings (`paths[]`).

        {% cut "Format for listing settings" %}

          ```yaml
          "update_mask": {
            "paths": [
              "<setting_1>",
              "<setting_2>",
              ...
              "<setting_N>"
            ]
          }
          ```

        {% endcut %}

        {% note warning %}
        
        When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the `update_mask` parameter.
        
        {% endnote %}

      * `permissions.sanitize_payload`: Data cleanup. The possible values are:

        * `sanitize-payload`: Data cleanup is enabled. This is the default value.
        * `skip-sanitize-payload`: Data cleanup is disabled.

  1. Call the [UserService.Update](../api-ref/grpc/User/update.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

      ```bash
      grpcurl \
        -format json \
        -import-path ~/cloudapi/ \
        -import-path ~/cloudapi/third_party/googleapis/ \
        -proto ~/cloudapi/yandex/cloud/mdb/redis/v1/user_service.proto \
        -rpc-header "Authorization: Bearer $IAM_TOKEN" \
        -d @ \
        mdb.api.cloud.yandex.net:443 \
        yandex.cloud.mdb.redis.v1.UserService.Update \
        < body.json
        ```

  1. Check the [server response](../api-ref/grpc/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Assigning user permissions {#change-permissions}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder containing the cluster.
  1. [Navigate to](../../console/operations/select-service.md#select-service) **Yandex Managed Service for&nbsp;Valkey™**.
  1. Click the name of your cluster and select the ![image](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Locate the user you need in the list, click ![image](../../_assets/console-icons/ellipsis.svg) in their row, and select **Configure**.
  1. Under `Permissions`, specify user permissions:

      * `Patterns`: Permissions for key patterns.
      * `Pub Sub Channels`: Permissions for Pub/Sub channels.
      * `Categories`: Permissions for command categories.
      * `Commands`: Permissions for commands.
        
      {% note info %}
      
      The user cannot get permissions for administrative commands of the `+@admin` category and [certain commands](../concepts/supported-features.md).
      
      {% endnote %}

      For more information about access control lists, see [this Valkey™ ACL guide](https://valkey.io/topics/acl).
  
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To assign permissions to a Valkey™ user:

  1. View the description of the CLI command for updating user settings:

      ```bash
      yc managed-redis user update --help
      ```

  1. Run this command to assign permissions to a user:

      ```bash
      yc managed-redis user update <username> \
        --cluster-id=<cluster_ID> \
        --raw="<permissions>" \
        --categories="<permissions_for_command_categories>" \
        --commands="<permissions_for_commands>" \
        --patterns="<permissions_for_key_patterns>" \
        --pub-sub-channels="<permissions_for_channels>"
      ```

      Where:

      * `--cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      * `--raw`: String of space-separated permissions. Also, the string must set the user status:

        * `on`: User is enabled.
        * `off`: User is disabled.

        Example: `on ~data:* &* +@set +@hash +get +set`.

        {% note info %}

        The `--raw` flag cannot be used with separate permission flags or with `--disabled` and `--enabled`.

        {% endnote %}

      * `--categories`: String of space-separated permissions for command categories.

      * `--commands`: String of space-separated permissions for commands.

      * `--patterns`: String of space-separated permissions for key patterns.

      * `--pub-sub-channels`: String of space-separated permissions for Pub/Sub channels.

      {% note info %}
      
      The user cannot get permissions for administrative commands of the `+@admin` category and [certain commands](../concepts/supported-features.md).
      
      {% endnote %}

      For more information about access control lists, see [this Valkey™ ACL guide](https://valkey.io/topics/acl).

      You can get the username with the [list of users](user-list.md#list) in the cluster.

- Terraform {#tf}

  1. Open the current Terraform configuration file with the infrastructure plan.

      For information on how to create this file, see [Creating a cluster](cluster-create.md).

  1. Update the arguments in the `permissions` section of the `yandex_mdb_redis_user` resource description:

      ```hcl
      resource "yandex_mdb_redis_user" "<local_resource_name>" {
        ...
        permissions = {
          categories       = "<permissions_for_command_categories>"
          commands         = "<permissions_for_commands>"
          patterns         = "<permissions_for_key_patterns>"
          pub_sub_channels = "<permissions_for_channels>"
          ...
        }
        ...
      }
      ```

      Where `permissions` is the user permission settings:

      * `categories`: String of space-separated permissions for command categories.

      * `commands`: String of space-separated permissions for commands.

      * `patterns`: String of space-separated permissions for key patterns.

      * `pub_sub_channels`: String of space-separated permissions for Pub/Sub channels.

      {% note info %}
      
      The user cannot get permissions for administrative commands of the `+@admin` category and [certain commands](../concepts/supported-features.md).
      
      {% endnote %}

      For more information about access control lists, see [this Valkey™ ACL guide](https://valkey.io/topics/acl).

  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm updating the resources.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  {% note warning "Timeouts" %}
  
  The Terraform provider sets the following timeouts for Yandex Managed Service for Valkey™ cluster operations:
  
  * Creating a cluster, including by restoring it from a backup: 15 minutes.
  * Editing a cluster: 60 minutes.
  * Deleting a cluster: 15 minutes.
  
  Operations exceeding the timeout are aborted.
  
  {% cut "How do I change these limits?" %}
  
  Add the `timeouts` section to your cluster description, such as the following:
  
  ```hcl
  resource "yandex_mdb_redis_cluster_v2" "<cluster_name>" {
    ...
    timeouts = {
      create = "1h30m" # 1 hour 30 minutes
      update = "2h"    # 2 hours
      delete = "30m"   # 30 minutes
    }
  }
  ```
  
  {% endcut %}
  
  {% endnote %}

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
        "updateMask": "<list_of_settings_to_update>",
        "permissions": {
          "patterns": "<permissions_for_key_patterns>",
          "pubSubChannels": "<permissions_for_channels>",
          "categories": "<permissions_for_command_categories>",
          "commands": "<permissions_for_commands>"
        }
      }
      ```

      Where:

      * `updateMask`: Comma-separated string of settings to update.

        {% note warning %}
        
        When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the `updateMask` parameter.
        
        {% endnote %}

      * `permissions.patterns`: String of space-separated permissions for key patterns.

      * `permissions.pubSubChannels`: String of space-separated permissions for Pub/Sub channels.

      * `permissions.categories`: String of space-separated permissions for command categories.

      * `permissions.commands`: String of space-separated permissions for commands.

      {% note info %}
      
      The user cannot get permissions for administrative commands of the `+@admin` category and [certain commands](../concepts/supported-features.md).
      
      {% endnote %}

      For more information about access control lists, see [this Valkey™ ACL guide](https://valkey.io/topics/acl).

  1. Call the [User.Update](../api-ref/User/update.md) method, e.g., via the following [cURL](https://curl.se/) request:

      ```bash
      curl \
        --request PATCH \
        --header "Authorization: Bearer $IAM_TOKEN" \
        --header "Content-Type: application/json" \
        --url 'https://mdb.api.cloud.yandex.net/managed-redis/v1/clusters/<cluster_ID>/users/<username>' \
        --data "@body.json"
      ```

      You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      You can get the username with the [list of users](user-list.md#list) in the cluster.

  1. Check the [server response](../api-ref/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.

  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
        "cluster_id": "<cluster_ID>",
        "user_name": "<username>",
        "update_mask": {
          "paths": [
            <list_of_settings_to_update>
          ]
        },
        "permissions": {
          "patterns": "<permissions_for_key_patterns>",
          "pub_sub_channels": "<permissions_for_channels>",
          "categories": "<permissions_for_command_categories>",
          "commands": "<permissions_for_commands>"
        }
      }
      ```

      Where:

      * `cluster_id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](cluster-list.md#list-clusters) in the folder.

      * `user_name`: Username.

        You can get the username with the [list of users](user-list.md#list) in the cluster.

      * `update_mask`: List of parameters to update as an array of strings (`paths[]`).

        {% cut "Format for listing settings" %}

          ```yaml
          "update_mask": {
            "paths": [
              "<setting_1>",
              "<setting_2>",
              ...
              "<setting_N>"
            ]
          }
          ```

        {% endcut %}

        {% note warning %}
        
        When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the `update_mask` parameter.
        
        {% endnote %}

      * `permissions.patterns`: String of space-separated permissions for key patterns.

      * `permissions.pub_sub_channels`: String of space-separated permissions for Pub/Sub channels.

      * `permissions.categories`: String of space-separated permissions for command categories.

      * `permissions.commands`: String of space-separated permissions for commands.

      {% note info %}
      
      The user cannot get permissions for administrative commands of the `+@admin` category and [certain commands](../concepts/supported-features.md).
      
      {% endnote %}

      For more information about access control lists, see [this Valkey™ ACL guide](https://valkey.io/topics/acl).

  1. Call the [UserService.Update](../api-ref/grpc/User/update.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

      ```bash
      grpcurl \
        -format json \
        -import-path ~/cloudapi/ \
        -import-path ~/cloudapi/third_party/googleapis/ \
        -proto ~/cloudapi/yandex/cloud/mdb/redis/v1/user_service.proto \
        -rpc-header "Authorization: Bearer $IAM_TOKEN" \
        -d @ \
        mdb.api.cloud.yandex.net:443 \
        yandex.cloud.mdb.redis.v1.UserService.Update \
        < body.json
        ```

  1. Check the [server response](../api-ref/grpc/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}