--- title: Valkey · How to Properly Secure Your Valkey Deployment description: A practical guide to securing Valkey deployments using layered defense: network boundaries (VPC, security groups, TLS), authentication via ACLs or requirepass,... canonical: https://daily.dev/posts/valkey-how-to-properly-secure-your-valkey-deployment-rm12vp9o5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Valkey · How to Properly Secure Your Valkey Deployment | daily.dev og:description: A practical guide to securing Valkey deployments using layered defense: network boundaries (VPC, security groups, TLS), authentication via ACLs or requirepass,... og:url: https://daily.dev/posts/valkey-how-to-properly-secure-your-valkey-deployment-rm12vp9o5 og:image: https://api.daily.dev/og/posts/Rm12vp9O5.png og:image:alt: Valkey · How to Properly Secure Your Valkey Deployment og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Valkey · How to Properly Secure Your Valkey Deployment **[Valkey](https://daily.dev/sources/valkey-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary A practical guide to securing Valkey deployments using layered defense: network boundaries (VPC, security groups, TLS), authentication via ACLs or requirepass, command-level restrictions with ACL examples, container hardening, and operational monitoring for anomalies like authentication failures. Emphasizes that no single control (like authentication alone) is sufficient, and provides a security checklist along with real-world compromise scenarios showing how layered controls catch different failure modes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I use ACLs to restrict a Valkey user to only read and write cache commands? Create a user with a scoped key pattern and limited command set, for example: ACL SETUSER cache_writer on >strongpassword ~cached:* +get +set +del +expire. This restricts the user to only the get, set, del, and expire commands on keys matching the cached:* pattern, following the principle of least privilege so a compromised credential can't affect unrelated data. _Developers hardening cache access controls can find configuration patterns like this on daily.dev._ ### What is a safe baseline ACL configuration for a general application client connecting to Valkey? A solid baseline is ACL SETUSER application on >password +@all -@dangerous -@scripting, which allows normal day-to-day commands but strips dangerous and scripting command categories. This keeps typical application operations functional while removing commands that are commonly abused if credentials are ever compromised. _Teams tuning Valkey or Redis permission models track practical ACL baselines on daily.dev._ ### Why shouldn't I rely on authentication alone to secure a Valkey or Redis instance? Authentication only protects against unauthorized network access, but credentials can leak through accidental GitHub commits, compromised microservices exposing environment variables, or application logs. Layered defenses catch what authentication misses: network segmentation blocks exposed credentials from reaching the instance, monitoring flags anomalous behavior from a compromised service, and ACLs limit the damage even if credentials are stolen. _Anyone designing defense-in-depth for a cache layer can weigh these tradeoffs using daily.dev._ ## Similar posts on daily.dev - [How to Secure a Kubernetes Cluster: RBAC, Pod Hardening, and Runtime Protection](https://daily.dev/posts/how-to-secure-a-kubernetes-cluster-rbac-pod-hardening-and-runtime-protection-dbiccqree) · freeCodeCamp · 4 upvotes · 0 comments - [A Brief Deep-Dive into Attacking and Defending Kubernetes](https://daily.dev/posts/a-brief-deep-dive-into-attacking-and-defending-kubernetes-vxcbvujil) · Tech Lead Digest · 5 upvotes · 0 comments - [Best of 2025: DevSecOps for Kubernetes: 15 Best Practices for 2025](https://daily.dev/posts/best-of-2025-devsecops-for-kubernetes-15-best-practices-for-2025-6egsozqi1) · Cloud Native Now · 0 upvotes · 0 comments - [The cookbook for safe, powerful agents](https://daily.dev/posts/the-cookbook-for-safe-powerful-agents-zgsjfvmwk) · InfoWorld · 0 upvotes · 0 comments - [Hardening the Core: Container Validation and Malicious Package Defense](https://daily.dev/posts/hardening-the-core-container-validation-and-malicious-package-defense-fm50k0pnh) · Container Journal · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#redis](https://daily.dev/tags/redis), [#valkey](https://daily.dev/tags/valkey) [View this post on daily.dev](https://daily.dev/posts/valkey-how-to-properly-secure-your-valkey-deployment-rm12vp9o5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Valkey · How to Properly Secure Your Valkey Deployment","url":"https://daily.dev/posts/valkey-how-to-properly-secure-your-valkey-deployment-rm12vp9o5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/valkey-how-to-properly-secure-your-valkey-deployment-rm12vp9o5"},"datePublished":"2026-08-23T12:23:18.122Z","dateModified":"2026-08-23T12:52:23.594Z","description":"A practical guide to securing Valkey deployments using layered defense: network boundaries (VPC, security groups, TLS), authentication via ACLs or requirepass,...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Valkey","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Valkey","logo":"https://media.daily.dev/image/upload/s--XXPzEmD8--/f_auto,q_auto/v1787487496/logos/valkey-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/valkey-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/valkey-how-to-properly-secure-your-valkey-deployment-rm12vp9o5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,redis,valkey","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Valkey","item":"https://daily.dev/sources/valkey-blog"},{"@type":"ListItem","position":3,"name":"Valkey · How to Properly Secure Your Valkey Deployment"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/valkey-how-to-properly-secure-your-valkey-deployment-rm12vp9o5#faq","mainEntity":[{"@type":"Question","name":"How do I use ACLs to restrict a Valkey user to only read and write cache commands?","acceptedAnswer":{"@type":"Answer","text":"Create a user with a scoped key pattern and limited command set, for example: ACL SETUSER cache_writer on >strongpassword ~cached:* +get +set +del +expire. This restricts the user to only the get, set, del, and expire commands on keys matching the cached:* pattern, following the principle of least privilege so a compromised credential can't affect unrelated data. Developers hardening cache access controls can find configuration patterns like this on daily.dev."}},{"@type":"Question","name":"What is a safe baseline ACL configuration for a general application client connecting to Valkey?","acceptedAnswer":{"@type":"Answer","text":"A solid baseline is ACL SETUSER application on >password +@all -@dangerous -@scripting, which allows normal day-to-day commands but strips dangerous and scripting command categories. This keeps typical application operations functional while removing commands that are commonly abused if credentials are ever compromised. Teams tuning Valkey or Redis permission models track practical ACL baselines on daily.dev."}},{"@type":"Question","name":"Why shouldn't I rely on authentication alone to secure a Valkey or Redis instance?","acceptedAnswer":{"@type":"Answer","text":"Authentication only protects against unauthorized network access, but credentials can leak through accidental GitHub commits, compromised microservices exposing environment variables, or application logs. Layered defenses catch what authentication misses: network segmentation blocks exposed credentials from reaching the instance, monitoring flags anomalous behavior from a compromised service, and ACLs limit the damage even if credentials are stolen. Anyone designing defense-in-depth for a cache layer can weigh these tradeoffs using daily.dev."}}]} ```