OpenSearch Vector Search Edition instances are deployed in a VPC and cannot be accessed from on-premises environments or the internet by default. Configure a public access whitelist to allow requests from specific IP addresses.
Procedure
On the instance details page, the Network Information section contains fields such as VPC ID and vSwitch ID.
Add a public access whitelist. By default, Public Access is turned off.
Enable Public Access manually. The whitelist configuration option then appears.
Click Public Access Whitelist to add, delete, or modify entries. If you close the configuration panel without saving, a confirmation prompt appears. Unsaved changes are discarded.
-
The whitelist configuration takes effect about one minute after you save it.
-
After you enable Public Access, a public endpoint is automatically generated. Use this endpoint to access the OpenSearch Vector Search Edition instance from the internet.
Copy the public endpoint: On the instance details page, copy the public endpoint from the Network Information section.
Add to the whitelist: Enter the IP addresses. Separate multiple entries with commas.
The whitelist input box supports a single IP address, such as 192.168.0.1, or a CIDR block, such as 192.168.0.0/24.
Use an online IP lookup service to find your machine's public IP address.
Verify the whitelist configuration: From a machine whose IP address is on the whitelist, ping the public endpoint to verify the configuration.
On your local machine, remove the http:// prefix and ping the endpoint. Ensure you ping the public endpoint, which has the public keyword in its hostname, such as ha-cn-xxxxxxxx.public.ha.aliyuncs.com:
C:\xxx>ping ha-cn-zpr3dgzxg04.public.ha.aliyuncs.com
Pinging ha-cn-zpr3dgzxg04.public.ha.aliyuncs.com [47.1xx.xx.129] with 32 bytes of data:
Reply from 47.102.32.129: bytes=32 time=9ms TTL=89
Reply from 47.102.32.129: bytes=32 time=10ms TTL=89A successful ping to the public endpoint confirms that the IP address was added to the whitelist correctly.
FAQ
If you receive an error similar to the following when accessing an OpenSearch Vector Search Edition instance using the public endpoint in an SDK:
Error: 403 Forbidden Response: {'errors': {'code': '403', 'message': 'Forbidden'}}
This error indicates an incorrect IP address configuration. To troubleshoot, temporarily add 0.0.0.0/0 to the whitelist to confirm the issue is related to your IP address settings.
The CIDR block 0.0.0.0/0 allows access from all IP addresses, which poses a security risk. Remove this entry after troubleshooting and add only trusted IP addresses to the whitelist.