Configure whitelists for a cluster

Precautions

• PolarDB cannot automatically obtain the private IP addresses of ECS instances in virtual private clouds (VPCs). If you want to use the private IP address of an ECS instance to access a PolarDB for MySQL cluster, you must manually add the IP address to the IP whitelist of the cluster.

• You can configure IP address whitelists and security group settings for an RDS instance. The ECS instances in the IP whitelist and the ECS instances in the security group that is added to the cluster whitelist can access the PolarDB for MySQL cluster.

• The ali_dms_group (for Data Management), hdm_security_ips (for Database Autonomy Service), and dtspolardb (for Data Transmission Service) whitelists are automatically created when you use the relevant services. To ensure that the services can be used as normal, do not modify or delete these IP whitelists.

  Important

  Do not add your service IP addresses to these IP whitelists. Otherwise, your service IP addresses may be overwritten when the related services are updated. Consequently, service interruption may occur.

  

• You can create up to 50 IP address whitelists for a cluster, and add up to 1,000 IP addresses or CIDR blocks to the whitelists in total.

Scenarios

A whitelist contains IP addresses or security groups that are allowed to access a PolarDB for MySQL cluster. You can configure an IP whitelist to reinforce the security of a PolarDB for MySQL cluster. We recommend that you update the IP whitelist on a regular basis. In most cases, you must configure an IP whitelist in the following scenarios:

• You want to connect your ECS instance to a PolarDB for MySQL cluster. You can find the IP addresses of the ECS instance in the Instance Details page. Then, add one of the IP addresses to the IP whitelist of the cluster.

  Note

  • Your ECS instance and the PolarDB for MySQL cluster are in the same VPC. Add the private IP address of the ECS instance or the CIDR block of the VPC to which the ECS instance belongs to the whitelist.

  • Your ECS instance and the PolarDB for MySQL cluster are not in the same VPC. Add the public IP address of the ECS instance or the security group to which the ECS instance belongs to the whitelist. You can also migrate the ECS instance to the VPC to which the PolarDB for MySQL cluster belongs. Then, add the private IP address of the ECS instance or the CIDR block of the VPC to which the ECS instance belongs to the whitelist.

• If you want to connect on-premises servers, computers, or other cloud instances to the PolarDB cluster, add the relevant public IP addresses to the IP whitelist of the cluster.

Procedure

1. Log on to the PolarDB console. Click Clusters in the left-side navigation pane. Select a region in the upper-left corner and click the ID of the cluster that you want to manage to go to the Basic Information page.

2. In the left-side navigation pane, choose Settings and Management > Whitelists.

3. On the Whitelists page, you can click Add IP Whitelist to add an IP whitelist or click Modify to modify an existing IP whitelist.

   • Add an IP whitelist

     Click Add IP Whitelist. In the Add IP Whitelist panel, specify the name of the IP whitelist and enter the IP addresses that are allowed to access the cluster.

   • Modify an IP whitelist

     On the right side of an IP whitelist name, click Modify. In the Modify Whitelist panel, enter the IP addresses that are allowed to access the cluster.

   Note

   • The name of the IP whitelist must meet the following requirements:

     • It can contain lowercase letters, digits, and underscores (_).

     • It must start with a letter and end with a letter or digit.

     • It must be 2 to 120 characters in length.

   • For IP addresses in the whitelist:

     • You can enter IP addresses and CIDR blocks. For example, you can enter the 192.168.0.1 IP address and the 192.168.0.0/24 CIDR block.

     • When you add multiple IP addresses or CIDR blocks, separate them with commas (,), for example, 192.168.0.1,192.168.0.0/24.

     • 127.0.0.1 indicates that no IP address is allowed to access the cluster.

     • 0.0.0.0/0 indicates that any IP address is allowed to access the cluster. To ensure the security of your database instance, we recommend that you do not add this IP address to the whitelist unless necessary.

   • A default IP whitelist that contains only the IP address 127.0.0.1 is automatically created for each cluster. This IP whitelist blocks all IP addresses.

FAQ

For more information, see Troubleshoot issues related to an IP whitelist.

References

• Configure a global IP whitelist template: You can configure one set of IP whitelist templates to manage the whitelists of all PolarDB clusters associated with the template.

• Configure a security group: After a security group is added, all ECS instances in the security group are added to the whitelist of the PolarDB cluster. Changes to the security group are automatically synchronized to the whitelist. You don't need to modify the whitelist of the PolarDB cluster after new ECS instances are added to the security group.

Related API operations