To ensure the security and stability of your AnalyticDB for PostgreSQL database, the system blocks all external IP addresses from accessing AnalyticDB for PostgreSQL instances by default. Before you use an AnalyticDB for PostgreSQL instance, you must add your client's IP address or CIDR block to the whitelist of the AnalyticDB for PostgreSQL instance. Proper use of a whitelist provides your AnalyticDB for PostgreSQL instance with a high level of access security. We recommend that you regularly maintain the whitelist.
Before you begin
Before you configure a whitelist for an AnalyticDB for PostgreSQL instance, you must obtain your client's IP address. The method varies depending on the location of your client.
|
Client location |
Network type |
Method |
|
ECS instance (recommended) |
VPC |
Find the IP address of an ECS instance Note
Make sure that the ECS instance and the AnalyticDB for PostgreSQL instance are in the same VPC. This means their VPC IDs must match. If they are in different VPCs, you can change the VPC for the ECS instance. For more information, see Change the VPC for an ECS instance. |
|
On-premises machine or third-party cloud |
Internet |
The method for obtaining the public IP address of your local machine varies depending on your network environment and operating system.
|
Procedure
- Log on to the AnalyticDB for PostgreSQL console.
- In the upper-left corner of the console, select a region.
- Find the instance that you want to manage and click the instance ID.
-
In the left-side navigation pane, click Security Controls.
-
On the Security Controls page, perform the following operations:
-
Create a whitelist group
-
Click Create Whitelist.
-
In the Create Whitelist dialog box, configure the following parameters.
Parameter
Description
Whitelist Name
The name of the new whitelist group. The name must meet the following requirements:
-
It must consist of lowercase letters, digits, or underscores (_).
-
It must start with a lowercase letter and end with a lowercase letter or a digit.
-
The name must be 2 to 32 characters in length.
IP Addresses
The IP addresses to add to the whitelist. Note the following:
-
Separate multiple IP addresses with commas (,). Duplicate IP addresses are not allowed. You can add a maximum of 999 IP addresses.
-
You can use IP addresses in the
10.23.12.24format and CIDR blocks in the10.23.12.24/24format. CIDR stands for Classless Inter-Domain Routing. In CIDR mode, /24 specifies the length of the address prefix. The prefix length can be an integer from 1 to 32. -
Setting the prefix length to 0, such as in
0.0.0.0/0or127.0.0.1/0, allows access from any IP address. This poses a high security risk. Proceed with caution. -
127.0.0.1denies access from all external IP addresses.
-
-
Click OK.
-
-
Modify the IP addresses in a whitelist group
-
Find the target whitelist group and click Modify in the Actions column.
-
In the IP Addresses field, add or delete IP addresses or CIDR blocks.
NoteYou cannot modify the Whitelist Name.
-
Click OK.
-
-
Delete a whitelist group
NoteYou cannot delete the default whitelist group.
-
Find the target whitelist group and click Delete in the Actions column.
-
In the Delete Whitelist dialog box, click OK.
-
-
Clear the default whitelist group
-
For the
defaultwhitelist group, click Clear in the Actions column. -
In the Clear Whitelist dialog box, click OK to clear the default whitelist group.
After you clear the default whitelist group, only
127.0.0.1remains.
-
-
Related APIs
|
API |
Description |
|
Queries the whitelisted IP addresses for an instance. |
|
|
Modifies the whitelists for an instance. |