All Products
Search
Document Center

AnalyticDB:Configure a whitelist

Last Updated:Aug 24, 2026

To ensure the security and stability of your AnalyticDB for PostgreSQL database, the system blocks all external IP addresses from accessing AnalyticDB for PostgreSQL instances by default. Before you use an AnalyticDB for PostgreSQL instance, you must add your client's IP address or CIDR block to the whitelist of the AnalyticDB for PostgreSQL instance. Proper use of a whitelist provides your AnalyticDB for PostgreSQL instance with a high level of access security. We recommend that you regularly maintain the whitelist.

Before you begin

Before you configure a whitelist for an AnalyticDB for PostgreSQL instance, you must obtain your client's IP address. The method varies depending on the location of your client.

Client location

Network type

Method

ECS instance (recommended)

VPC

Find the IP address of an ECS instance

Note

Make sure that the ECS instance and the AnalyticDB for PostgreSQL instance are in the same VPC. This means their VPC IDs must match. If they are in different VPCs, you can change the VPC for the ECS instance. For more information, see Change the VPC for an ECS instance.

On-premises machine or third-party cloud

Internet

The method for obtaining the public IP address of your local machine varies depending on your network environment and operating system.

  • Linux: Open a terminal and run the curl ifconfig.me command.

  • Windows: On your local device, visit Query my IP to obtain the public IP address.

  • macOS: Open the Terminal app and run the curl ifconfig.me command.

Procedure

  1. Log on to the AnalyticDB for PostgreSQL console.
  2. In the upper-left corner of the console, select a region.
  3. Find the instance that you want to manage and click the instance ID.
  4. In the left-side navigation pane, click Security Controls.

  5. On the Security Controls page, perform the following operations:

    • Create a whitelist group

      1. Click Create Whitelist.

      2. In the Create Whitelist dialog box, configure the following parameters.

        Parameter

        Description

        Whitelist Name

        The name of the new whitelist group. The name must meet the following requirements:

        • It must consist of lowercase letters, digits, or underscores (_).

        • It must start with a lowercase letter and end with a lowercase letter or a digit.

        • The name must be 2 to 32 characters in length.

        IP Addresses

        The IP addresses to add to the whitelist. Note the following:

        • Separate multiple IP addresses with commas (,). Duplicate IP addresses are not allowed. You can add a maximum of 999 IP addresses.

        • You can use IP addresses in the 10.23.12.24 format and CIDR blocks in the 10.23.12.24/24 format. CIDR stands for Classless Inter-Domain Routing. In CIDR mode, /24 specifies the length of the address prefix. The prefix length can be an integer from 1 to 32.

        • Setting the prefix length to 0, such as in 0.0.0.0/0 or 127.0.0.1/0, allows access from any IP address. This poses a high security risk. Proceed with caution.

        • 127.0.0.1 denies access from all external IP addresses.

      3. Click OK.

    • Modify the IP addresses in a whitelist group

      1. Find the target whitelist group and click Modify in the Actions column.

      2. In the IP Addresses field, add or delete IP addresses or CIDR blocks.

        Note

        You cannot modify the Whitelist Name.

      3. Click OK.

    • Delete a whitelist group

      Note

      You cannot delete the default whitelist group.

      1. Find the target whitelist group and click Delete in the Actions column.

      2. In the Delete Whitelist dialog box, click OK.

    • Clear the default whitelist group

      1. For the default whitelist group, click Clear in the Actions column.

      2. In the Clear Whitelist dialog box, click OK to clear the default whitelist group.

        After you clear the default whitelist group, only 127.0.0.1 remains.

Related APIs

API

Description

DescribeDBInstanceIPArrayList

Queries the whitelisted IP addresses for an instance.

ModifySecurityIps

Modifies the whitelists for an instance.