This topic describes how to change the network type of an ApsaraDB RDS for PostgreSQL instance between classic network and virtual private cloud (VPC).

Network types

  • Classic network: RDS instances in the classic network are not isolated. You can configure whitelists on these instances to block unauthorized access.
  • VPC: Each VPC is an isolated network. We recommend that you select the VPC network type because it is more secure than the classic network.

    You can configure route tables, Classless Inter-Domain Routing (CIDR) blocks, and gateways in a VPC. In addition, you can connect your self-managed data center to a VPC by using leased lines or VPNs. This allows you to build a virtual data center on the cloud, so you can smoothly migrate applications to the cloud.

Note

Change the network type from VPC to classic network

Precautions

  • After you change the network type from VPC to classic network, the internal endpoint of your RDS instance remains unchanged. However, the IP address that is associated with the internal endpoint changes.
  • After you change the network type from VPC to classic network, you cannot access your RDS instance by using the internal endpoint. This applies to an Alibaba Cloud Elastic Compute Service (ECS) instance that no longer resides in the same VPC as your RDS instance. Make sure that you immediately update the endpoint information on your application after you change the network type.
  • When you change the network type, a transient connection error of about 30 seconds may occur. To avoid interruptions to your workloads, we recommend that you perform the network type change during off-peak hours. Alternatively, make sure that your application is configured to automatically reconnect to your RDS instance.
  • If your RDS instance runs PostgreSQL 11, 12, or 13, you cannot change the network type from VPC to classic network.

Procedure

  1. Visit the RDS instance list, select a region above, and click the target instance ID.
  2. In the left-side navigation pane, click Database Connection.
  3. On the page that appears, click Switch to Classic Network.
  4. In the message that appears, click OK.

    After you change the network type, only a classic network-housed ECS instance can access your RDS instance over an internal network. You must modify the ECS instance to configure the internal endpoint that is used to connect to your RDS instance.

  5. Configure an IP address whitelist to allow access from a classic network-housed ECS instance over an internal network.
    • If your RDS instance runs in standard whitelist mode, you can add the private IP address of the classic network-housed ECS instance to an IP address whitelist of the classic or VPC network type.
    • If your RDS instance runs in enhanced whitelist mode, you can add the private IP address of the classic network-housed ECS instance only to an IP address whitelist of the classic network type. For more information, see Switch an ApsaraDB RDS for PostgreSQL instance to the enhanced whitelist mode. If no IP address whitelists of the classic network type are available, create one.

Change the network type from classic network to VPC

Procedure

  1. Visit the RDS instance list, select a region above, and click the target instance ID.
  2. In the left-side navigation pane, click Database Connection.
  3. Click Switch to other VPC.
  4. In the dialog box that appears, select a VPC and a vSwitch, and specify whether to retain the classic network endpoint.
    • Select a VPC. We recommend that you select the VPC where the required ECS instance resides. If the ECS and RDS instances reside in different VPCs, these instances cannot communicate over an internal network unless you create a Cloud Enterprise Network (CEN) or gateway between the VPCs of these instances. For more information, see Overview of Alibaba Cloud CEN and Establish IPsec-VPN connections between two VPCs.
    • Select a vSwitch. If no vSwitches are available in the selected VPC, create one in the same zone where your RDS instance resides. For more information, see Create a vSwitch.
    • Clear or select the Reserve original classic endpoint option. For more information, see the following table.
      Action Description
      Clear the Reserve original classic endpoint option

      The classic network endpoint is not retained and will be converted to a VPC endpoint.

      When you change the network type from classic network to VPC, a transient connection error of about 30 seconds will occur. In this case, the connection between each classic network-housed ECS instance and your RDS instance is closed.
      Select the Reserve original classic endpoint option

      The classic network endpoint is retained, and a new VPC endpoint is generated. In this case, your RDS instance runs in hybrid access mode. This indicates that both classic network- and VPC-housed ECS instances can access your RDS instance over internal networks. For more information, see Configure a hybrid access solution to smoothly migrate an RDS instance from the classic network to a VPC.

      When you change the network type from classic network to VPC, no transient connection errors will occur. The connection between each classic network-housed ECS instance and your RDS instance remains available until the classic network endpoint expires.

      Before the classic network endpoint expires, you must add the VPC endpoint to the required ECS instance. This allows you to migrate your workloads to the selected VPC without interruptions. In addition, before the classic network endpoint expires, the system sends a text message to the phone number that is bound to your Alibaba Cloud account for seven consecutive days.

      For more information, see Configure the hybrid access solution for an ApsaraDB RDS for PostgreSQL instance.

  5. Add the private IP address of the required ECS instance in the selected VPC to an IP address whitelist of the VPC network type. This allows the ECS instance to access your RDS instance over an internal network. If no IP address whitelists of the VPC network type are available, create one.
  6. Add the VPC endpoint of your RDS instance to the required ECS instance.
    • If you have selected the Reserve original classic endpoint option, add the generated VPC endpoint to each VPC-housed ECS instance before the classic network endpoint expires.
    • If you have cleared the Reserve original classic endpoint option, the connection between each classic network-housed ECS instance and your RDS instance is immediately closed after you change the network type. You must immediately add the generated VPC endpoint to each VPC-housed ECS instance after you change the network type.
    Note If you want to connect a classic network-housed ECS instance to the VPC-housed RDS instance over an internal network, you can use ClassicLink to establish a connection. Alternatively, you can migrate the ECS instance to the same VPC as your RDS instance. For more information, see Overview.

FAQ

How do I change the VPC of my RDS instance?

You cannot directly change the VPC of your RDS instance. You can change the VPC by using the following methods:

  • If your RDS instance supports changes between the classic and VPC network types, perform the following steps:
    1. Change the network type from VPC to classic network.
    2. Change the network type from classic network to VPC. During this process, select the VPC that you want.
  • If your RDS instance does not support changes between the classic and VPC network types, perform the following steps:

    Purchase a new RDS instance that resides in the required VPC, and then migrate the data of your RDS instance to the new RDS instance. For more information, see Migrate data between ApsaraDB RDS instances.

Related operations

Operation Description
ModifyDBInstanceNetworkType Changes the network type of an ApsaraDB RDS instance.