Updating user settings

Written by

Yandex Cloud

Updated at October 30, 2025

Changing the user password
Changing the user status
Configuring data cleanup
Assigning user permissions

After creating a Valkey™ user, you can:

Changing the user password

CLI

Terraform

REST API

gRPC API

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

To change a Valkey™ user's password:

See the description of the CLI command for updating the user settings:
```
yc managed-redis user update --help
```
Change the password by running this command:
```
yc managed-redis user update <username> \
  --cluster-id=<cluster_ID> \
  --password="<user_password>" 
```
Where:
- --cluster-id: Cluster ID.
  
  You can get the cluster ID with the list of clusters in the folder.
- --password: Password. The password must be from 8 to 128 characters long.
You can get the username with the list of users in the cluster.

Open the current Terraform configuration file describing your infrastructure.

For more information about creating this file, see this guide.
Update the passwords parameter in the yandex_mdb_redis_user resource description:
```
resource "yandex_mdb_redis_user" "<local_resource_name>" {
  ...
  passwords  = ["<user_password>"]
  ...
}
```
Where passwords is the user password. The password must be from 8 to 128 characters long.

You can specify only one password.
Validate your configuration.
1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
2. Run this command:
```
terraform validate
```
  Terraform will show any errors found in your configuration files.
Confirm resource changes.
1. Run this command to view the planned changes:
```
terraform plan
```
  If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
2. If everything looks correct, apply the changes:
  1. Run this command:
```
terraform apply
```
  2. Confirm updating the resources.
  3. Wait for the operation to complete.

Time limits

A Terraform provider sets the timeout for Yandex Managed Service for Valkey™ cluster operations:

Creating a cluster, including by restoring one from a backup: 15 minutes.
Editing a cluster: 60 minutes.
Deleting a cluster: 15 minutes.

Operations exceeding the set timeout are interrupted.

How do I change these limits?

Add the timeouts block to the cluster description, for example:

resource "yandex_mdb_redis_cluster" "<cluster_name>" {
  ...
  timeouts {
    create = "1h30m" # 1 hour 30 minutes
    update = "2h"    # 2 hours
    delete = "30m"   # 30 minutes
  }
}

Get an IAM token for API authentication and save it as an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Create a file named body.json and paste the following code into it:
```
{
  "updateMask": "passwords",
  "passwords": [
    "<user_password>"
  ]
}
```
Where:
- updateMask: Comma-separated list of parameters to update.
  
  Warning
  
  When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the updateMask parameter.
- passwords: Password. The password must be from 8 to 128 characters long.
  
  You can specify only one password.

Use the User.Update method and send the following request, e.g., via cURL:

curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-redis/v1/clusters/<cluster_ID>/users/<username>' \
  --data "@body.json"

You can get the cluster ID with the list of clusters in the folder.

You can get the username with the list of users in the cluster.

Check the server response to make sure your request was successful.

Get an IAM token for API authentication and save it as an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume the repository contents are stored in the ~/cloudapi/ directory.
Create a file named body.json and paste the following code into it:
```
{
  "cluster_id": "<cluster_ID>",
  "user_name": "<username>",
  "update_mask": {
    "paths": [
      "passwords"
    ]
  },
  "passwords": [
    "<user_password>"
  ]
}
```
Where:
- cluster_id: Cluster ID.
  
  You can get the cluster ID with the list of clusters in the folder.
- user_name: Username.
  
  You can get the username with the list of users in the cluster.
- update_mask: List of settings you want to update as an array of paths[] strings.
  Format for listing settings
  "update_mask": { "paths": [ "<setting_1>", "<setting_2>", ... "<setting_N>" ] }
  Warning
  
  When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the update_mask parameter.
- passwords: Password. The password must be from 8 to 128 characters long.
  
  You can specify only one password.

Use the UserService.Update call and send the following request, e.g., via gRPCurl:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/redis/v1/user_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d @ \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.redis.v1.UserService.Update \
  < body.json

Check the server response to make sure your request was successful.

Changing the user status

CLI

Terraform

REST API

gRPC API

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

To change a Valkey™ user’s status:

See the description of the CLI command for updating the user settings:
```
yc managed-redis user update --help
```
Change the user status by running this command:
```
yc managed-redis user update <username> \
  --cluster-id=<cluster_ID> \
  <user_status> 
```
Where:
- --cluster-id: Cluster ID.
  
  You can get the cluster ID with the list of clusters in the folder.
- Specify one of these user status flags:
  - --disabled: User is disabled.
  - --enabled: User is enabled.
You can get the username with the list of users in the cluster.

Open the current Terraform configuration file describing your infrastructure.

For more information about creating this file, see this guide.
Update the enabled parameter in the yandex_mdb_redis_user resource description:
```
resource "yandex_mdb_redis_user" "<local_resource_name>" {
  ...
  enabled = <user_status>
  ...
}
```
Where enabled is the user status. The possible values are:
- true: User is enabled.
- false: User is disabled.
Validate your configuration.
1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
2. Run this command:
```
terraform validate
```
  Terraform will show any errors found in your configuration files.
Confirm resource changes.
1. Run this command to view the planned changes:
```
terraform plan
```
  If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
2. If everything looks correct, apply the changes:
  1. Run this command:
```
terraform apply
```
  2. Confirm updating the resources.
  3. Wait for the operation to complete.

Time limits

A Terraform provider sets the timeout for Yandex Managed Service for Valkey™ cluster operations:

Creating a cluster, including by restoring one from a backup: 15 minutes.
Editing a cluster: 60 minutes.
Deleting a cluster: 15 minutes.

Operations exceeding the set timeout are interrupted.

How do I change these limits?

Add the timeouts block to the cluster description, for example:

resource "yandex_mdb_redis_cluster" "<cluster_name>" {
  ...
  timeouts {
    create = "1h30m" # 1 hour 30 minutes
    update = "2h"    # 2 hours
    delete = "30m"   # 30 minutes
  }
}

Get an IAM token for API authentication and save it as an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Create a file named body.json and paste the following code into it:
```
{
  "updateMask": "enabled",
  "enabled": <user_status>
}
```
Where:
- updateMask: Comma-separated list of parameters to update.
  
  Warning
  
  When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the updateMask parameter.
- enabled: User status. The possible values are:
  - true: User is enabled.
  - false: User is disabled.

Use the User.Update method and send the following request, e.g., via cURL:

curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-redis/v1/clusters/<cluster_ID>/users/<username>' \
  --data "@body.json"

You can get the cluster ID with the list of clusters in the folder.

You can get the username with the list of users in the cluster.

Check the server response to make sure your request was successful.

Get an IAM token for API authentication and save it as an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume the repository contents are stored in the ~/cloudapi/ directory.
Create a file named body.json and paste the following code into it:
```
{
  "cluster_id": "<cluster_ID>",
  "user_name": "<username>",
  "update_mask": {
    "paths": [
      "enabled"
    ]
  },
  "enabled": <user_status>
}
```
Where:
- cluster_id: Cluster ID.
  
  You can get the cluster ID with the list of clusters in the folder.
- user_name: Username.
  
  You can get the username with the list of users in the cluster.
- update_mask: List of settings you want to update as an array of paths[] strings.
  Format for listing settings
  "update_mask": { "paths": [ "<setting_1>", "<setting_2>", ... "<setting_N>" ] }
  Warning
  
  When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the update_mask parameter.
- enabled: User status. The possible values are:
  - true: User is enabled.
  - false: User is disabled.

Use the UserService.Update call and send the following request, e.g., via gRPCurl:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/redis/v1/user_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d @ \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.redis.v1.UserService.Update \
  < body.json

Check the server response to make sure your request was successful.

Configuring data cleanup

CLI

Terraform

REST API

gRPC API

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

To configure data cleanup:

See the description of the CLI command for updating the user settings:
```
yc managed-redis user update --help
```
Configure data cleanup by running this command:
```
yc managed-redis user update <username> \
  --cluster-id=<cluster_ID> \
  --sanitize-payload=<data_cleanup> 
```
Where:
- --cluster-id: Cluster ID.
  
  You can get the cluster ID with the list of clusters in the folder.
- --sanitize-payload: Data cleanup. The possible values are:
  - sanitize-payload: Data cleanup is enabled. This is the default value.
  - skip-sanitize-payload: Data cleanup is disabled.
You can get the username with the list of users in the cluster.

Open the current Terraform configuration file describing your infrastructure.

For more information about creating this file, see this guide.
Update the sanitize_payload parameter in the yandex_mdb_redis_user resource description:
```
resource "yandex_mdb_redis_user" "<local_resource_name>" {
  ...
  sanitize_payload = "<data_cleanup>"
  ...
}
```
Where --sanitize-payload represents data cleanup. The possible values are:
- sanitize-payload: Data cleanup is enabled. This is the default value.
- skip-sanitize-payload: Data cleanup is disabled.
Validate your configuration.
1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
2. Run this command:
```
terraform validate
```
  Terraform will show any errors found in your configuration files.
Confirm resource changes.
1. Run this command to view the planned changes:
```
terraform plan
```
  If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
2. If everything looks correct, apply the changes:
  1. Run this command:
```
terraform apply
```
  2. Confirm updating the resources.
  3. Wait for the operation to complete.

Time limits

A Terraform provider sets the timeout for Yandex Managed Service for Valkey™ cluster operations:

Creating a cluster, including by restoring one from a backup: 15 minutes.
Editing a cluster: 60 minutes.
Deleting a cluster: 15 minutes.

Operations exceeding the set timeout are interrupted.

How do I change these limits?

Add the timeouts block to the cluster description, for example:

resource "yandex_mdb_redis_cluster" "<cluster_name>" {
  ...
  timeouts {
    create = "1h30m" # 1 hour 30 minutes
    update = "2h"    # 2 hours
    delete = "30m"   # 30 minutes
  }
}

Get an IAM token for API authentication and save it as an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Create a file named body.json and paste the following code into it:
```
{
  "updateMask": "permissions.sanitizePayload",
  "permissions": {
    "sanitizePayload": "<data_cleanup>"
  }
}
```
Where:
- updateMask: Comma-separated list of parameters to update.
  
  Warning
  
  When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the updateMask parameter.
- permissions.sanitizePayload: Data cleanup. The possible values are:
  - sanitize-payload: Data cleanup is enabled. This is the default value.
  - skip-sanitize-payload: Data cleanup is disabled.

Use the User.Update method and send the following request, e.g., via cURL:

curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-redis/v1/clusters/<cluster_ID>/users/<username>' \
  --data "@body.json"

You can get the cluster ID with the list of clusters in the folder.

You can get the username with the list of users in the cluster.

Check the server response to make sure your request was successful.

Get an IAM token for API authentication and save it as an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume the repository contents are stored in the ~/cloudapi/ directory.
Create a file named body.json and paste the following code into it:
```
{
  "cluster_id": "<cluster_ID>",
  "user_name": "<username>",
  "update_mask": {
    "paths": [
      "permissions.sanitize_payload"
    ]
  },
  "permissions": {
    "sanitize_payload": "<data_cleanup>"
  }
}
```
Where:
- cluster_id: Cluster ID.
  
  You can get the cluster ID with the list of clusters in the folder.
- user_name: Username.
  
  You can get the username with the list of users in the cluster.
- update_mask: List of settings you want to update as an array of paths[] strings.
  Format for listing settings
  "update_mask": { "paths": [ "<setting_1>", "<setting_2>", ... "<setting_N>" ] }
  Warning
  
  When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the update_mask parameter.
- permissions.sanitize_payload: Data cleanup. The possible values are:
  - sanitize-payload: Data cleanup is enabled. This is the default value.
  - skip-sanitize-payload: Data cleanup is disabled.

Use the UserService.Update call and send the following request, e.g., via gRPCurl:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/redis/v1/user_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d @ \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.redis.v1.UserService.Update \
  < body.json

Check the server response to make sure your request was successful.

Assigning user permissions

CLI

Terraform

REST API

gRPC API

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

To assign permissions to a Valkey™ user:

See the description of the CLI command for updating the user settings:
```
yc managed-redis user update --help
```
To assign permissions to a user, run this command:
```
yc managed-redis user update <username> \
  --cluster-id=<cluster_ID> \
  --raw="<permissions>" \
  --categories="<permissions_for_command_categories>" \
  --commands="<permissions_for_commands>" \
  --patterns="<permissions_for_key_templates>" \
  --pub-sub-channels="<permissions_for_channels>"
```
Where:
- --cluster-id: Cluster ID.
  
  You can get the cluster ID with the list of clusters in the folder.
- --raw: String of space-separated permissions. Also, the string must set the user status:
  - on: User is enabled.
  - off: User is disabled.
  Example: on ~data:* &* +@set +@hash +get +set.
  
  Note
  
  The --raw flag cannot be used with separate permission flags or with the --disabled and --enabled flags.
- --categories: String of space-separated permissions for command categories.
- --commands: String of space-separated permissions for commands.
- --patterns: String of space-separated permissions for key templates.
- --pub-sub-channels: String of space-separated permissions for Pub/Sub channels.
Note

The user cannot get permissions for administrative commands of the +@admin category and some commands.

For more information about access control lists, see this Valkey™ ACL guide.

You can get the username with the list of users in the cluster.

Open the current Terraform configuration file describing your infrastructure.

For more information about creating this file, see this guide.
Update the parameters under permissions in the yandex_mdb_redis_user resource description:
```
resource "yandex_mdb_redis_user" "<local_resource_name>" {
  ...
  permissions = {
    categories       = "<permissions_for_command_categories>"
    commands         = "<permissions_for_commands>"
    patterns         = "<permissions_for_key_templates>"
    pub_sub_channels = "<permissions_for_channels>"
    ...
  }
  ...
}
```
Where permissions represents the user permission settings:
- categories: String of space-separated permissions for command categories.
- commands: String of space-separated permissions for commands.
- patterns: String of space-separated permissions for key templates.
- pub_sub_channels: String of space-separated permissions for Pub/Sub channels.
Note

The user cannot get permissions for administrative commands of the +@admin category and some commands.

For more information about access control lists, see this Valkey™ ACL guide.
Validate your configuration.
1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
2. Run this command:
```
terraform validate
```
  Terraform will show any errors found in your configuration files.
Confirm resource changes.
1. Run this command to view the planned changes:
```
terraform plan
```
  If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
2. If everything looks correct, apply the changes:
  1. Run this command:
```
terraform apply
```
  2. Confirm updating the resources.
  3. Wait for the operation to complete.

Time limits

A Terraform provider sets the timeout for Yandex Managed Service for Valkey™ cluster operations:

Creating a cluster, including by restoring one from a backup: 15 minutes.
Editing a cluster: 60 minutes.
Deleting a cluster: 15 minutes.

Operations exceeding the set timeout are interrupted.

How do I change these limits?

Add the timeouts block to the cluster description, for example:

resource "yandex_mdb_redis_cluster" "<cluster_name>" {
  ...
  timeouts {
    create = "1h30m" # 1 hour 30 minutes
    update = "2h"    # 2 hours
    delete = "30m"   # 30 minutes
  }
}

Get an IAM token for API authentication and save it as an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Create a file named body.json and paste the following code into it:
```
{
  "updateMask": "<list_of_parameters_to_update>",
  "permissions": {
    "patterns": "<permissions_for_key_templates>",
    "pubSubChannels": "<permissions_for_channels>",
    "categories": "<permissions_for_command_categories>",
    "commands": "<permissions_for_commands>"
  }
}
```
Where:
- updateMask: Comma-separated list of parameters to update.
  
  Warning
  
  When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the updateMask parameter.
- permissions.patterns: String of space-separated permissions for key templates.
- permissions.pubSubChannels: String of space-separated permissions for Pub/Sub channels.
- permissions.categories: String of space-separated permissions for command categories.
- permissions.commands: String of space-separated permissions for commands.
Note

The user cannot get permissions for administrative commands of the +@admin category and some commands.

For more information about access control lists, see this Valkey™ ACL guide.

Use the User.Update method and send the following request, e.g., via cURL:

curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-redis/v1/clusters/<cluster_ID>/users/<username>' \
  --data "@body.json"

You can get the cluster ID with the list of clusters in the folder.

You can get the username with the list of users in the cluster.

Check the server response to make sure your request was successful.

Get an IAM token for API authentication and save it as an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume the repository contents are stored in the ~/cloudapi/ directory.
Create a file named body.json and paste the following code into it:
```
{
  "cluster_id": "<cluster_ID>",
  "user_name": "<username>",
  "update_mask": {
    "paths": [
      <list_of_parameters_to_update>
    ]
  },
  "permissions": {
    "patterns": "<permissions_for_key_templates>",
    "pub_sub_channels": "<permissions_for_channels>",
    "categories": "<permissions_for_command_categories>",
    "commands": "<permissions_for_commands>"
  }
}
```
Where:
- cluster_id: Cluster ID.
  
  You can get the cluster ID with the list of clusters in the folder.
- user_name: Username.
  
  You can get the username with the list of users in the cluster.
- update_mask: List of settings you want to update as an array of paths[] strings.
  Format for listing settings
  "update_mask": { "paths": [ "<setting_1>", "<setting_2>", ... "<setting_N>" ] }
  Warning
  
  When you update a user, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the update_mask parameter.
- permissions.patterns: String of space-separated permissions for key templates.
- permissions.pub_sub_channels: String of space-separated permissions for Pub/Sub channels.
- permissions.categories: String of space-separated permissions for command categories.
- permissions.commands: String of space-separated permissions for commands.
Note

The user cannot get permissions for administrative commands of the +@admin category and some commands.

For more information about access control lists, see this Valkey™ ACL guide.

Use the UserService.Update call and send the following request, e.g., via gRPCurl:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/redis/v1/user_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d @ \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.redis.v1.UserService.Update \
  < body.json

View the server response to make sure your request was successful.

Updating user settings

Changing the user passwordChanging the user password

Changing the user statusChanging the user status

Configuring data cleanupConfiguring data cleanup

Assigning user permissionsAssigning user permissions

Was the article helpful?

Changing the user password

Changing the user status

Configuring data cleanup

Assigning user permissions