All Products
Search
Document Center

ApsaraDB RDS:Configure a distributed transaction whitelist

Last Updated:Jan 24, 2024

To ensure transaction consistency and isolation, you can configure a distributed transaction whitelist for your ApsaraDB RDS for SQL Server instances. You can configure a whitelist to specify which Elastic Compute Service (ECS) instances are allowed to participate in distributed transactions of RDS instances. This improves system security and stability and facilitates troubleshooting of transaction consistency issues. This topic describes how to configure a distributed transaction whitelist for an RDS instance.

Prerequisites

The RDS instance meets the following requirements:

  • The RDS instance runs SQL Server 2022 EE (Always On), SQL Server 2019 EE (Always On), SQL Server 2017 EE (Always On), SQL Server 2016 EE, SQL Server 2012 EE, SQL Server 2022 SE, SQL Server 2019 SE, SQL Server 2017 SE, SQL Server 2016 SE, SQL Server 2012 SE, or SQL Server 2008 R2 with cloud disks.

  • The RDS instance runs RDS High-availability Edition or RDS Cluster Edition.

  • The RDS instance belongs to the general-purpose or dedicated instance family. The shared instance family is not supported.

Note

You can go to the Basic Information page of your RDS instance to view the preceding information.

Configure the RDS instance

  1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
  2. In the left-side navigation pane of the page that appears, click Whitelist and SecGroup. On the Whitelist Settings tab of the page that appears, click Modify to the right of the IP address whitelist that is labeled default and add the IP address of the ECS instance to the whitelist.

    Note
    • If the ECS instance and RDS instance reside in the same virtual private cloud (VPC), you must enter the private IP address of the ECS instance. You can view the private IP address of the ECS instance on the Instance Details page of the ECS instance in the ECS console.

    • If the ECS instance and RDS instance reside in different VPCs, you must enter the public IP address of the ECS instance. In addition, you must apply for a public endpoint for the RDS instance. For more information, see Apply for or release a public endpoint.

    Ip地址

  3. Click OK.

  4. In the left-side navigation pane, click Data Security. On the page that appears, click the Distributed Transaction Whitelist tab.

  5. Click Create Whitelist. In the dialog box that appears, configure the following parameters and click OK.

    Parameter

    Description

    Whitelist Name:

    Enter a name for the whitelist. The name must be 2 to 32 characters in length. The name can contain digits, lowercase letters, and underscores (_). The name must start with a lowercase letter and end with a lowercase letter or digit.

    IP Addresses

    Enter the IP address of the ECS instance and the name of the Windows computer on which the ECS instance resides. Separate the IP address and the computer name with a comma (,). Example: 192.168.1.100,k3ecstest.

    If you want to enter more than one entry, make sure that each entry is in a different line.

    Note

    To view the computer name, open Control Panel > System and Security > System.

Configure the ECS instance

  1. Log on to the ECS console.

  2. In the left-side navigation pane, choose Instances & Images > Instances.

  3. In the top navigation bar, select the region in which the instance resides.

  4. Find the ECS instance and click the instance ID.

  5. In the top navigation bar, click Security Groups.

  6. Find the security group that you want to manage and click Configure Rules in the Actions column.

  7. On the Inbound tab, click Add Rule.

  8. Configure the parameters and then click Save. The following table describes the parameters.

    Parameter

    Description

    Action

    Select Allow.

    Priority

    Retain the default value 1.

    Protocol Type

    Select Custom TCP.

    Port Range

    Enter 135.

    Note

    Port 135 is the fixed port for the Remote Procedure Call (RPC) service.

    Authorization Object

    Enter the two IP addresses of the RDS instance in the Authorization Object field. You can view these IP addresses on the Distributed Transaction Whitelist tab of the Data Security page.分布式事务白名单

    Description

    Enter a description. The description must be 2 to 256 characters in length, and cannot start with http:// or https://.

  9. Create another security group rule. This rule has the same parameter settings as the previous rule except for the Port Range parameter. Set the Port Range parameter to 1024/65535.

References