This topic describes how to configure an IP address whitelist for an ApsaraDB RDS for PostgreSQL instance. An IP address whitelist allows only the specified devices to access your RDS instance.

For more information about how to configure an IP address whitelist for an RDS instance that runs a different database engine, see the following topics:

Scenarios

An IP address whitelist consists of IP addresses and CIDR blocks that are granted access to the RDS instance. You can configure IP address whitelists for an RDS instance to provide high-level access control and security protection for the RDS instance. We recommend that you update the configured IP address whitelists on a regular basis.

You need to configure an IP address whitelist in the following scenarios:

  • Scenario 1

    After an RDS instance is created, you must add the IP addresses of specific devices to an IP address whitelist of the instance. Then, these devices can access the RDS instance.

  • Scenario 2

    An RDS instance cannot be connected. In this case, you need to check the IP address whitelists of the RDS instance. Then, you can modify the IP address whitelists that are improperly configured.

    The following table provides the IP address whitelist configurations in various connection scenarios.

    Note A virtual private cloud (VPC) is an isolated network on Alibaba Cloud. It provides higher security than the classic network. For more information, see What is a VPC?
    Connection scenarioNetwork typeIP address whitelist configuration
    Connect an Elastic Compute Service (ECS) instance to the RDS instanceThe ECS instance and the RDS instance reside in the same VPC. This is the recommended connection method.Add the private IP address of the ECS instance to an IP address whitelist of the RDS instance.
    The ECS instance and the RDS instance reside in different VPCs.Instances in different VPCs cannot communicate with each other over internal networks. In this case, perform the following operations:
    1. Migrate the RDS instance to the VPC in which the ECS instance resides.
      Note This operation is supported only when the ECS instance and the RDS instance reside in the same region. If the ECS instance and the RDS instance reside in different regions, we recommend that you use Data Transmission Service (DTS) to migrate the RDS instance to the region in which the ECS instance resides. This way, you can ensure the stability of the database service. For more information, see Migrate data between ApsaraDB RDS for PostgreSQL instances.
    2. Add the private IP address of the ECS instance to an IP address whitelist of the RDS instance.
    The ECS instance and the RDS instance reside in the classic network.Add the private IP address of the ECS instance to an IP address whitelist of the RDS instance.
    The ECS instance resides in the classic network.

    The RDS instance resides in a VPC.

    		Instances of different network types cannot communicate with each other over internal networks. In this case, perform the following operations:
    1. Migrate the ECS instance from the classic network to the VPC in which the RDS instance resides. For more information, see Migrate an ECS instance from the classic network to a VPC.
      Note This operation is supported only when the ECS instance and the RDS instance reside in the same region. If the ECS instance and the RDS instance reside in different regions, we recommend that you use DTS to migrate the RDS instance to the region in which the ECS instance resides. This way, you can ensure the stability of the database service. For more information, see Migrate data between ApsaraDB RDS for PostgreSQL instances.
    2. Add the private IP address of the ECS instance to an IP address whitelist of the RDS instance.
    The ECS instance resides in a VPC.

    The RDS instance resides in the classic network.

    		Instances of different network types cannot communicate with each other over internal networks. In this case, perform the following operations:
    1. Migrate the RDS instance from the classic network to the VPC in which the ECS instance resides.
      Note This operation is supported only when the ECS instance and the RDS instance reside in the same region. If the ECS instance and the RDS instance reside in different regions, we recommend that you use DTS to migrate the RDS instance to the region in which the ECS instance resides. This way, you can ensure the stability of the database service. For more information, see Migrate data between ApsaraDB RDS for PostgreSQL instances.
    2. Add the private IP address of the ECS instance to an IP address whitelist of the RDS instance.
    Connect a self-managed host outside the cloud to the RDS instanceNone.Add the public IP address of the self-managed host to an IP address whitelist of the RDS instance.
    Note

Usage notes

  • A maximum of 50 IP address whitelists can be configured for each RDS instance.
  • When you configure IP address whitelists, the workloads on the RDS instance are not interrupted.
  • You can delete the entries in the IP address whitelist that is labeled default but you cannot delete the whitelist.
  • Do not modify or delete the IP address whitelists that are automatically generated for other Alibaba Cloud services. If you delete the IP address whitelist that is automatically generated for an Alibaba Cloud service, the Alibaba Cloud service cannot connect to the RDS instance. For example, the IP address whitelist labeled ali_dms_group is generated for Data Management (DMS), and the IP address whitelist labeled hdm_security_ips is generated for Database Autonomy Service (DAS).
    Important If an RDS instance is created after December 2020, the IP address whitelist that is labeled hdm_security_ips is invisible to users. This prevents the IP address whitelist from being modified due to unintentional operations or deleted.
  • The IP address whitelist that is labeled default contains only the IP address 127.0.0.1. This indicates that no IP addresses can access the RDS instance.

Configure a standard IP address whitelist

In standard whitelist mode, ApsaraDB RDS does not distinguish between the classic network and VPCs. The IP addresses or CIDR blocks in a standard IP address whitelist can be used to access the RDS instance over both the classic network and VPCs.

  1. Access RDS Instances, select a region at the top, and then click the ID of the target RDS instance.
  2. In the left-side navigation pane of the page that appears, click Whitelist and SecGroup.
  3. Click Create Whitelist. In the dialog box that appears, configure parameters such as Whitelist Name to create an IP address whitelist. Alternatively, click Modify to the right of an existing IP address whitelist to modify the IP address whitelist.
  4. Enter the IP addresses or CIDR blocks that require access to your RDS instance. Then, click OK.
    Note
    • If you enter more than one IP address or CIDR block, you must separate these IP addresses or CIDR blocks with commas (,). Do not add spaces preceding or following the commas. Example: 192.168.0.1,172.16.213.9.
    • A maximum of 1,000 IP addresses and CIDR blocks can be configured for each RDS instance. If you want to enter a large number of IP addresses, we recommend that you merge the IP addresses into CIDR blocks, such as 10.10.10.0/24.
  5. Optional. If a read-only RDS instance is attached to the RDS instance, configure the Synchronize Whitelist to Read-only Instance parameter to synchronize the IP address whitelists of the RDS instance to the read-only RDS instance. If multiple read-only RDS instances are attached to the RDS instance, you can select more than one read-only RDS instance for synchronization.
    Synchronize Whitelist to Read-only Instance
  6. Optional. Click Add Internal IP Addresses of ECS Instances. In the dialog box that appears, view the IP addresses of all the ECS instances that are created within your Alibaba Cloud account. Then, add the IP addresses of the ECS instances that you want to connect to the IP address whitelist. Add Internal IP Addresses of ECS Instances

Configure an enhanced IP address whitelist

In enhanced whitelist mode, ApsaraDB RDS distinguishes between the classic network and VPCs. You must specify the network isolation mode of each enhanced IP address whitelist. For example, if the Network Isolation Mode parameter is set to Classic Network for an IP address whitelist, the IP addresses in the IP address whitelist are granted access to the RDS instance only over the classic network, and you cannot connect to the RDS instance over VPCs from these IP addresses.

The enhanced whitelist mode is supported only for RDS instances that use local SSDs. If your RDS instance runs in enhanced whitelist mode, you can perform the following procedure to configure an enhanced IP address whitelist. For more information about how to switch the network isolation mode of an RDS instance from the standard whitelist mode to the enhanced whitelist mode, see Switch an ApsaraDB RDS for PostgreSQL instance to the enhanced whitelist mode.

  1. Access RDS Instances, select a region at the top, and then click the ID of the target RDS instance.
  2. In the left-side navigation pane of the page that appears, click Whitelist and SecGroup.
  3. On the Whitelist Settings tab, create or modify an IP address whitelist.
    • Create an IP address whitelist
      1. Click Create Whitelist.
      2. Configure the Network Isolation Mode parameter.
      3. Enter a name in the Whitelist Name field, add IP addresses or CIDR blocks, and then click OK.
    • Modify an IP address whitelist

      Click Modify to the right of the IP address whitelist.

  4. In the Edit Whitelist dialog box, add IP addresses or CIDR blocks and click OK.
    Note
    • If you enter more than one IP address or CIDR block, you must separate these IP addresses or CIDR blocks with commas (,). Do not add spaces preceding or following the commas. Example: 192.168.0.1,172.16.213.9.
    • A maximum of 1,000 IP addresses and CIDR blocks can be configured for each RDS instance. If you want to enter a large number of IP addresses, we recommend that you merge the IP addresses into CIDR blocks, such as 10.10.10.0/24.
  5. Optional. If a read-only RDS instance is attached to the RDS instance, configure the Synchronize Whitelist to Read-only Instance parameter to synchronize the IP address whitelists of the RDS instance to the read-only RDS instance. If multiple read-only RDS instances are attached to the RDS instance, you can select more than one read-only RDS instance for synchronization.
    Synchronize Whitelist to Read-only Instance
  6. Optional. Click Add Internal IP Addresses of ECS Instances. In the dialog box that appears, view the IP addresses of all the ECS instances that are created within your Alibaba Cloud account. Then, add the IP addresses of the ECS instances that you want to connect to the IP address whitelist. Add Internal IP Addresses of ECS Instances

What to do next

Create a database and an account on an ApsaraDB RDS for PostgreSQL instance

Related operations

OperationDescription
DescribeDBInstanceIPArrayListQueries the IP address whitelists of an instance.
ModifySecurityIpsModifies an IP address whitelist of an instance.