RabbitMQ Users & Permissions
Manage users, virtual hosts, and permissions within RabbitMQ to control access to resources. Implement fine-grained security policies for your messaging environment.
RabbitMQ Users & Permissions is a free RabbitMQ Messaging & Async Systems lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the RabbitMQ Messaging & Async Systems learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Security Matters in RabbitMQ
In any messaging system, controlling who can send and receive messages is crucial. RabbitMQ provides robust mechanisms to manage access, ensuring only authorized users interact with your message broker.
This lesson will guide you through setting up users, virtual hosts, and permissions to secure your RabbitMQ environment.
Users: Your First Line of Defense
A user in RabbitMQ represents an application or person connecting to the broker. Each user has a username and password for authentication.
By default, RabbitMQ creates a 'guest' user, but it's best practice to create dedicated users for your applications.
To create a new user, you use the rabbitmqctl command:
rabbitmqctl add_user my_app_user strong_passwordVirtual Hosts (Vhosts) for Isolation
Virtual hosts (or vhosts) act like separate, isolated RabbitMQ brokers within a single instance. They provide logical grouping and resource separation for different applications or environments.
- Each vhost has its own exchanges, queues, and bindings.
- Users are granted permissions to specific vhosts.
To create a vhost:
rabbitmqctl add_vhost /my_application_vhostThe Three Pillars of Permissions
Once you have users and vhosts, you need to define what each user can do within a specific vhost. RabbitMQ permissions are categorized into three types:
- Configure: For creating, deleting, and altering exchanges and queues.
- Write: For sending (publishing) messages to exchanges.
- Read: For receiving (consuming) messages from queues.
Configure Permissions: Managing Resources
The configure permission allows a user to manage RabbitMQ resources like exchanges and queues. If a user needs to declare (create) or delete queues and exchanges, they need this permission.
The permission regex applies to the names of the resources.
rabbitmqctl set_permissions \
-p /my_vhost \
my_app_user \
"^my_queue.*" \
".*" \
".*"Write Permissions: Sending Messages
The write permission allows a user to publish messages to exchanges within a vhost. Without this, a producer application cannot send messages.
The regex in the second position defines which exchanges the user can write to.
rabbitmqctl set_permissions \
-p /my_vhost \
my_app_user \
".*" \
"^my_exchange.*" \
".*"Read Permissions: Receiving Messages
The read permission allows a user to consume messages from queues within a vhost. This is essential for consumer applications to receive messages.
The regex in the third position defines which queues the user can read from.
rabbitmqctl set_permissions \
-p /my_vhost \
my_app_user \
".*" \
".*" \
"^my_queue.*"Granting Full Access to a Vhost
Often, an application user needs full control over their dedicated vhost. You can grant all three permissions (configure, write, read) to a user for all resources in a vhost using the ".*" regex for all three permission types.
This means 'match any resource name'.
rabbitmqctl set_permissions \
-p /my_vhost \
my_app_user \
".*" \
".*" \
".*"The Special 'Guest' User
RabbitMQ comes with a default user named guest with password guest. This user has full administrative permissions over all vhosts.
- Crucially: The 'guest' user can only connect from
localhostby default. - For production environments, it is highly recommended to delete this user or change its password and restrict its access, and create specific users with minimal necessary permissions.
Permission Check
A new application needs to connect to RabbitMQ, declare a queue named 'tasks_queue', and then consume messages from it. Which set of permissions does its user need on the /app_vhost?
Recap: Users, Vhosts & Permissions
You've learned how to secure your RabbitMQ instance by managing user access. Here's a quick summary:
- Users authenticate client applications.
- Virtual Hosts (Vhosts) provide isolated environments.
- Permissions (Configure, Write, Read) control what users can do within a vhost.
- Always use specific users and minimal permissions, especially for production.
Next, we'll explore how to encrypt these connections with SSL/TLS!
Frequently asked questions
Is the “RabbitMQ Users & Permissions” lesson free?
Yes — the full text of “RabbitMQ Users & Permissions” is free to read here on the web, and the RabbitMQ Messaging & Async Systems course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the RabbitMQ Messaging & Async Systems course, upgrade to CoddyKit PRO.
What will I learn in “RabbitMQ Users & Permissions”?
Manage users, virtual hosts, and permissions within RabbitMQ to control access to resources. Implement fine-grained security policies for your messaging environment. You practise RabbitMQ Messaging & Async Systems with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start RabbitMQ Messaging & Async Systems?
No prior experience is required. RabbitMQ Messaging & Async Systems on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “RabbitMQ Users & Permissions” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this RabbitMQ Messaging & Async Systems lesson?
Yes. Every RabbitMQ Messaging & Async Systems lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- RabbitMQ Users & Permissions
- SSL/TLS for Secure Connections
- RabbitMQ Management Plugin & Metrics
- Virtual Hosts for Multi-Tenant Isolation