All Products
Search

This Product

    Alibaba Cloud Service Mesh:Configure blacklists or whitelists in ASM security policies to implement access control

    Document Center

    Alibaba Cloud Service Mesh:Configure blacklists or whitelists in ASM security policies to implement access control

    Last Updated:Jun 20, 2026

    To implement precise control over the access permissions of users on services, you can configure a blacklist or whitelist in the corresponding security policies of Service Mesh (ASM). Blacklists and whitelists are common authorization mechanisms that prohibit or allow specified requests to access applications. ASM allows you to configure blacklists and whitelists to control east-west traffic and north-south traffic from multiple dimensions, such as IP addresses, HTTP domain names, and ports. This guarantees the security of applications in ASM. This topic describes how to configure a blacklist for east-west traffic in an ASM security policy.

    Prerequisites

    Procedure

    1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

    2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > ASMSecurityPolicy.

    3. On the ASMSecurityPolicy page, click Create. In the Create ASMSecurityPolicy dialog box, click Black/White List and then click OK.

    4. In the Workload and Match Rules step of the configuration wizard, configure the parameters and click Submit.

      Parameter

      Description

      ASMSecurityPolicyName

      Set the name to test.

      Workload List

      1. Click Add Workload.

      2. In the Add Workload dialog box, select the Workload Scope checkbox. Set Namespaces to default and Workload Type to Service.

      3. In the Select workloads section, select productpage, click the 添加 icon to add the selected workload to the selected section, and then click OK.

      Match Rule List

      Set Match Mode to Black List, turn on the Port switch, and enter 9080. This configuration denies all requests to port 9080 of the productpage pod.

      After the policy is created, the configuration wizard displays the message ASM security policy created successfully in the Complete step. You can click View YAML to view the resource YAML file or click Complete to return to the ASMSecurityPolicy page and view the new security policy.

    5. Run the following command to check whether the blacklist configurations take effect: 

      curl ${ASM_GATEWAY_IP}/productpage -I

      Expected output:

      HTTP/1.1 403 Forbidden
content-length: 19
content-type: text/plain
date: Fri, 22 Dec 2023 03:07:26 GMT
server: istio-envoy
x-envoy-upstream-service-time: 10

      An HTTP 403 response is returned. This indicates that you do not have permission to access the productpage application, confirming that the blacklist is effective.

    References