Elasticsearch:Use whitelist templates to configure IP whitelists in bulk

Availability

The IP whitelist template feature is available in all regions.

Create a whitelist template and associate clusters

1. Log on to the Elasticsearch console. In the navigation pane, choose IP Whitelist Template.

2. Click Create IP Whitelist Template and configure the following settings:

   • IP Whitelist Template Name: Enter a unique name for the template. The name must be unique within your Alibaba Cloud account.

   • IP Address Whitelist Type: Select ES private whitelist or ES public whitelist based on your use case.

   • IP Addresses in Whitelist: Enter the IP addresses or CIDR blocks to allow access. A template can contain up to 300 IP addresses or CIDR blocks. Separate multiple entries with a comma (,). Do not add spaces before or after the comma.

     Important

     • Setting the CIDR block to 0.0.0.0/0 allows public access from the internet. Use this setting with caution.

     • If a whitelist contains only 127.0.0.1, all access is denied. If other IP addresses or CIDR blocks are also configured, the 127.0.0.1 entry has no effect.

   • Associated Instance: When creating the template, you can select the clusters to associate with it. The system automatically filters and displays clusters that match the template type (public or private) and region.

3. Click OK. If the precheck is successful, the new template appears in the template list. If any configuration fails the check, the template is not created.

   You can also manage the IP whitelist on the details page of an associated cluster. For more information, see Associate or disassociate a template from a cluster.

Associate or disassociate a template

In addition to associating clusters from the template page, you can go to a specific cluster and associate or disassociate whitelist templates on its Security Settings page.

On the Security Settings page of the cluster, click Modify Private IP Address Whitelist or Public Network Access Whitelist.

• VPC private access whitelist

• Public access whitelist

Manage IP whitelist templates

In the template list, you can modify your templates, view their details, and delete them.

Actions	Description
Modify	Modify the basic information of a template, such as its name and IP addresses. When you change the template content, such as IP addresses, this operation pushes the updates to all associated clusters, keeping their whitelists consistent with the template.
Details	View the details of a template, including the IP addresses it contains and the list of associated clusters.
Delete	Delete the template. Important If a template is associated with any clusters, you must disassociate it from all clusters before you can delete it.

Quotas and limits

The following quotas and limits apply to IP whitelist templates:

Item	Description
Total IP capacity per cluster	Each Alibaba Cloud Elasticsearch cluster has a total IP whitelist capacity of 300 IP addresses or CIDR blocks. This capacity is the sum of the IPs configured directly on the cluster and the unique IPs from all associated templates.
Maximum templates per cluster	Each cluster can be associated with up to 10 IP whitelist templates: 5 for private access and 5 for public access.
Maximum clusters per template	Each IP whitelist template can be associated with up to 30 Alibaba Cloud Elasticsearch clusters.