ApsaraDB for Redis:Disable high-risk commands

Background information

In specific scenarios, unlimited use of commands may cause issues. Specific commands such as FLUSHALL and FLUSHDB clear most or all of the data. Improper use of commands such as KEYS and HGETALL may block the ApsaraDB for Redis service and affect service performance. You can disable specific commands based on your business needs.

To ensure stable instance performance, ApsaraDB for Redis does not allow commands such as CONFIG to be disabled. For more information, see High-risk commands that cannot be disabled.

Procedure

1. Log on to the ApsaraDB for Redis console and go to the Instances page. In the top navigation bar, select the region in which the instance that you want to manage resides. Then, find the instance and click the instance ID.

2. In the left-side navigation pane, click Parameter Settings.

3. On the System Parameters tab, find the #no_loose_disabled-commands parameter and click Modify in the Actions column.

4. In the dialog box that appears, specify the commands that you want to disable.

   Important

   • The commands that you specify can contain only lowercase letters. Separate multiple commands with commas (,). Example: keys,flushdb.

   • After you disable a command, its subcommands are also disabled. For example, after you disable the script command, commands such as SCRIPT EXISTS and SCRIPT LOAD are also disabled. However, you cannot disable subcommands individually.

5. Click OK.

Results

If you use redis-cli to connect to an instance and run the disabled FLUSHALL command, ApsaraDB for Redis returns the following error: (error) ERR command 'FLUSHALL' not support for normal user.

High-risk commands that cannot be disabled

The following commands cannot be disabled: CONFIG, MIGRATE, RESTORE-ASKING, LASTSAVE, BGREWRITEAOF, REPLICAOF, BGSAVE, PFDEBUG, PFSELFTEST, SLAVEOF, ACL-related commands, MODULE-related commands, and DEBUG-related commands.

Related API operations