Home/Learn/RabbitMQ/Permissions & Access Control

Permissions & Access Control

Intermediate

Operations

RabbitMQ permissions are per-vhost with configure, write, and read regexes per user; grant least-privilege access — separate produce-only and consume-only users.

Overview

RabbitMQ's permission model is per-user, per-vhost. Each user is assigned three regexes for a vhost: configure (declare/delete exchanges and queues matching the pattern), write (publish to exchanges matching the pattern), and read (consume from / purge queues matching the pattern). The special pattern ".*" grants full access; "^$" or "" denies all operations of that type. Tags control management UI and API access: administrator, monitoring, management, policymaker, impersonator. The guest user (default password: guest) is restricted to localhost connections only for security. In production, create dedicated service accounts with minimal required permissions.

Granting Least-Privilege Permissions

Separate producer and consumer accounts with minimal permissions. A producer needs write access to its exchange; a consumer needs read access to its queue. Neither needs configure permissions after initial setup.

Shell — least-privilege producer / consumer accounts

# Create producer user — can only publish to order-related exchanges
rabbitmqctl add_user order-producer StrongPass1!
rabbitmqctl set_permissions -p /orders order-producer   "^$"            # configure: cannot declare anything
  "^orders\..*"   # write: publish to exchanges matching orders.*
  "^$"             # read:  cannot consume

# Create consumer user — can only consume from order queues
rabbitmqctl add_user order-consumer StrongPass2!
rabbitmqctl set_permissions -p /orders order-consumer   "^$"                # configure: no
  "^$"                # write: no publishing
  "^orders\..*"       # read: consume from queues matching orders.*

# List current permissions
rabbitmqctl list_permissions -p /orders

Management Tags

Tags control what a user can see and do in the management plugin (HTTP API and UI). administrator can do everything including user management; monitoring can view statistics; management can log in to the UI.

Shell — management tags for different roles

# Grant monitoring-only access (read-only dashboard)
rabbitmqctl add_user ops-monitor MonitorPass!
rabbitmqctl set_user_tags ops-monitor monitoring

# Grant full admin access for the platform team
rabbitmqctl add_user admin AdminPass!
rabbitmqctl set_user_tags admin administrator

# Grant management UI login but no admin rights
rabbitmqctl add_user developer DevPass!
rabbitmqctl set_user_tags developer management
rabbitmqctl set_permissions -p /orders developer ".*" ".*" ".*"

# Tags: none | management | policymaker | monitoring | administrator

Securing the Guest User and TLS

The default guest user must be locked down or deleted before exposing the broker to a network. Combine user permissions with TLS client certificates for mutual authentication in production.

Shell / YAML — securing guest user and TLS configuration

# Delete or rename the default guest user
rabbitmqctl delete_user guest
# OR restrict guest to localhost only (rabbitmq.conf)
# loopback_users.guest = true  (default — guest cannot connect remotely)

# Enable TLS (rabbitmq.conf)
listeners.ssl.default = 5671
ssl_options.cacertfile = /etc/rabbitmq/ca.pem
ssl_options.certfile   = /etc/rabbitmq/server-cert.pem
ssl_options.keyfile    = /etc/rabbitmq/server-key.pem
ssl_options.verify     = verify_peer
ssl_options.fail_if_no_peer_cert = true

# Spring Boot — connect over TLS
spring:
  rabbitmq:
    port: 5671
    ssl:
      enabled: true
      key-store: classpath:client.p12
      trust-store: classpath:truststore.p12

Key Points to Remember

1Three permission regexes per user per vhost: configure (declare), write (publish), read (consume)
2".*" = full access; "^$" = no access; use specific patterns for least privilege
3Management tags (administrator, monitoring, management) control HTTP API / UI access
4Guest user is localhost-only by default — delete or restrict it before exposing the broker
5Create one service account per service with only the permissions that service needs
6Combine user permissions with TLS mutual auth for defence-in-depth in production

Interview Questions

What are the three permission types in RabbitMQ and what does each control?

EasyPivotal

Why is the default guest user restricted to localhost connections?

EasyTCS

How would you create a produce-only service account for RabbitMQ?

MediumAmazon

What is the difference between management tags and vhost permissions?

MediumZalando

How do you enforce mTLS (mutual TLS) for RabbitMQ client connections?

HardNetflix

Ask Aria about Permissions & Access Control

Your personal AI tutor — ask anything about this concept

Revision Status

Personal Notes

Discussion

Loading discussion…

TLS & Authentication

Monitoring & Alerting