Step 2: Configure whitelists

Preparations

Before you configure a whitelist for an ApsaraDB for Redis instance, you must obtain the IP addresses of clients based on the client installation locations.

Methods of configuring a whitelist

Method 1: Manually add a whitelist

1. Log on to the ApsaraDB for Redis console and go to the Instances page. In the top navigation bar, select the region in which the instance is deployed. Then, find the instance and click the instance ID.
2. In the left-side navigation pane, click Whitelist Settings.
3. Find the default whitelist and click Modify.
   Note You can also click Add Whitelist to create a whitelist. The name of a whitelist must be 2 to 32 characters in length and can contain lowercase letters, digits, and underscores (_). It must start with a lowercase letter and end with a lowercase letter or digit.
4. In the dialog box that appears, perform one of the following operations:
   • Manually add IP addresses or CIDR blocks to the whitelist.

     

     Note

     • Separate multiple IP addresses with commas (,). A maximum of 1,000 unique IP addresses can be added. You can enter specific IP addresses and CIDR blocks described in the following section:
       • Specific IP addresses. Example: 10.23.12.24.
       • CIDR blocks. Example: 10.23.12.0/24. /24 indicates the length of the IP address prefix. An IP address prefix can be 1 to 32 bits in length. 10.23.12.0/24 indicates an IP address range from 10.23.12.0 to 10.23.12.255. For more information about CIDR blocks, see FAQ about CIDR blocks.
     • If you enter CIDR blocks that have a prefix length of 0 such as 0.0.0.0/0 and 127.0.0.1/0, all IP addresses are allowed to access the instance. This poses a high security risk. Proceed with caution.
   • Add private IP addresses of ECS instances to the whitelist.
     1. Click Load ECS Internal Network IP.

        The private IP addresses of ECS instances that are deployed in the same region as the ApsaraDB for Redis instance are displayed.

     2. Select IP addresses based on your business requirements.

        

        Note To find the ECS instance that is assigned a specific IP address, you can move the pointer over the IP address. Then, the system displays the ID and name of the ECS instance to which the IP address is assigned.
5. Click OK.
6. Optional: To delete all IP addresses of a whitelist, click Delete in the Actions column corresponding to the whitelist.
   Default whitelists generated by the system cannot be deleted, such as default and hdm_security_ips.

Method 2: Add ECS security groups as whitelists

You can add ECS security groups as whitelists for the ApsaraDB for Redis instance. Then, the ECS instances in the security groups can access the ApsaraDB for Redis instance over an internal network or the Internet. The ApsaraDB for Redis instance must have a public endpoint if you want to access the instance over the Internet. For more information, see Use a public endpoint to connect to an ApsaraDB for Redis instance.

1. Log on to the ApsaraDB for Redis console and go to the Instances page. In the top navigation bar, select the region in which the instance is deployed. Then, find the instance and click the instance ID.
2. In the left-side navigation pane, click Whitelist Settings.
3. Click Security Groups.
4. On the Security Groups tab, click Add Security Group.
5. In the dialog box that appears, select the security groups that you want to add as whitelists.

   You can use a security group name or security group ID to perform fuzzy search.

   

   Note You can add up to 10 security groups as whitelists for each ApsaraDB for Redis instance.
6. Click OK.
7. Optional: To remove all security groups, click Delete.

References

• Use a public endpoint to connect to an ApsaraDB for Redis instance
• Connect an ECS instance to an ApsaraDB for Redis instance in different types of networks

Related API operations

FAQ

• Q: Why are whitelists automatically created for an ApsaraDB for Redis instance? Can I delete these whitelists?

  A: After you create an ApsaraDB for Redis instance, a default whitelist is automatically created. After you perform specific operations on the instance, more whitelists are automatically created, as described in the following table.

  Whitelist name	Source
  default	The default whitelist that cannot be deleted.
  ali_dms_group	This whitelist is automatically created by Data Management (DMS) when you log on to an ApsaraDB for Redis instance from DMS. For more information, see Log on to an ApsaraDB for Redis instance by using DMS. Do not delete or modify this whitelist. Otherwise, you may be unable to log on to the ApsaraDB for Redis instance from DMS.
  hdm_security_ips	This whitelist is automatically created by Database Autonomy Service (DAS) when you use CloudDBA-related features such as cache analysis. For more information, see Offline key analysis. Do not delete or modify this whitelist. Otherwise, the CloudDBA-related features may become unavailable.

• Q: A whitelist contains IP address 127.0.0.1 in addition to client IP addresses. In this case, can these clients connect to the ApsaraDB for Redis instance?

  A: Yes, these clients can connect to the ApsaraDB for Redis instance. If only 127.0.0.1 exists in the whitelist, all IP addresses are not allowed to connect to the ApsaraDB for Redis instance.

• Q: Why does the (error) ERR illegal address message appear after I use the redis-cli tool to connect to an ApsaraDB for Redis instance?

  A: The IP address of the client where you use the redis-cli tool is not added to a whitelist of the ApsaraDB for Redis instance. You must check the whitelists of the ApsaraDB for Redis instance.

• Q: If the IP address of my client is not added to a whitelist of an ApsaraDB for Redis instance, can I check port connectivity by running the telnet command?
  A: Yes, you can run the telnet command to check port connectivity. The following output is returned after you run the telnet command:

  Escape character is '^]'.
  Connection closed by foreign host.