MaxCompute:Manage IP address whitelists

By using the CLI

The parameter for the IP address whitelist for the public network and cloud product interconnection network is odps.security.ip.whitelist. The parameter for VPCs is odps.security.vpc.whitelist. For more information about the command syntax and parameters, see View project properties.

Run the following commands to add IP addresses to an IP address whitelist:

• If you configure an IP address whitelist only for the public network and the cloud product interconnection network, access from these networks is restricted, and all access from VPCs is denied.

  setproject odps.security.ip.whitelist=192.168.0.0 odps.security.vpc.whitelist=\N;

  To restrict access only from non-VPC networks without limiting access from VPCs, you can use the asterisk (*) wildcard character for VPCs:

  setproject odps.security.ip.whitelist=192.168.0.0 odps.security.vpc.whitelist=*;

  When you configure the IP address whitelist for the public network and cloud product interconnection network, include the IP address of the device where you run the MaxCompute client to avoid blocking your own access. If the configured whitelist does not include the VPC from which you are making the request, the command fails with a risk warning. Example:

  odps@ xxx>setproject odps.security.ip.whitelist=192.168.1.xxx;
  FAILED: Yourself will be banned by your new IP/VPC whitelist!
  Test result: vpc:'cn-hangzhou_123' or '123' not in vpc white list. project: lyh_meta1

• If you configure an IP address whitelist only for a VPC, access from the VPC is restricted, and all access from the public network and the cloud product interconnection network is denied.

  setproject odps.security.ip.whitelist=\N odps.security.vpc.whitelist=<vpc-instance-id>[192.168.0.10,192.168.0.20];

  To configure access control only for a VPC without disabling access from non-VPC networks, you can use the 0.0.0.0/0 wildcard IP address:

  setproject odps.security.ip.whitelist=0.0.0.0/0 odps.security.vpc.whitelist=<vpc-instance-id>[192.168.0.10,192.168.0.20];

• If you need to configure IP address whitelists for both the public network/cloud product interconnection network and a VPC, access from both network types is restricted.

  setproject odps.security.ip.whitelist=192.168.0.0 odps.security.vpc.whitelist=<vpc-instance-id>[192.168.0.10,192.168.0.20];

• If you need to configure whitelists with multiple IP addresses for the public network/cloud product interconnection network and multiple VPCs, use the following format.

  setproject odps.security.ip.whitelist=192.168.0.0,192.168.0.10 odps.security.vpc.whitelist=<vpc-instance-id1>[192.168.0.10,192.168.0.20],<vpc-instance-id2>;

  Separate multiple public network or cloud product interconnection network IP addresses with commas (,). For VPC IP addresses, use the format <VPC instance ID>[IP address list]. To whitelist all IP addresses from a specific VPC, specify only its VPC instance ID.

By using the console

In the MaxCompute console, select your region. On the Projects page, find your project and click Manage in the Actions column. Then, on the Parameter Configuration tab, edit the IP Address Whitelist.

• Public network and cloud product interconnection network IP: Separate multiple IP addresses with commas (,). If you configure an IP address whitelist only for the public network and the cloud product interconnection network, access from these networks is restricted, and all access from VPCs is denied. If you do not want to restrict access from VPCs, you can set the "VPC network IP" parameter to the asterisk (*) wildcard character.

• VPC network IP: Separate multiple IP addresses with commas (,). If you configure an IP address whitelist only for a VPC, access from the VPC is restricted, and all access from the public network and the cloud product interconnection network is denied. Example: <vpc-instance-id1>[192.168.0.10,192.168.0.20],<vpc-instance-id2>. To configure access control only for the VPC without disabling access from non-VPC networks, set the "Public network and cloud product interconnection network IP" parameter to the 0.0.0.0/0 wildcard.