ApsaraDB RDS:Configure a whitelist

Usage notes

• You can modify or clear the default IP whitelist, but you cannot delete it.

• Each instance supports up to 50 whitelists.

• A single whitelist can contain a maximum of 1,000 IP addresses or CIDR blocks. We recommend that you consolidate individual IP addresses into CIDR blocks, such as 10.10.10.0/24 (CIDR).

• Whitelists such as ali_dms_group (the whitelist for DMS) and hdm_security_ips (the whitelist for DAS) are system-generated. Do not modify or delete them to avoid disrupting related services.

  Important

  • Do not add your application's IP addresses to these system-generated whitelists. Service updates might overwrite your entries and cause service interruptions.

  • To prevent accidental modification or deletion, the hdm_security_ips whitelist is hidden for instances created after December 2020.

Configure a whitelist

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Whitelist and Security Group.

3. On the Whitelist Settings tab, click Modify next to the default whitelist.

   Note

   You can also click Create Whitelist to create a custom whitelist.

4. In the Modify Whitelist dialog box, enter the IP addresses or CIDR blocks to allow access to the instance, and then click OK.

   Note

   • When you add a new IP address or CIDR block to the default whitelist, the system automatically removes the 127.0.0.1 entry.

   • To add multiple entries, separate them with a comma. Do not add spaces. Example: 192.168.0.1,172.16.213.9.

   • After you click Add Internal IP Address of ECS Instance, the system displays the IP addresses of all ECS instances in your Alibaba Cloud account, which you can then add to the whitelist.

   • If your application is deployed in a container within an ACK cluster, the IP address that you need to add depends on the container network plugin.

     • If the ACK cluster uses the Flannel network plugin, add the node IP where your application is running.

     • If the ACK cluster uses the Terway network plugin, add the pod IP of your application.

     You can find the pod IP and node IP on the Pods page of your target ACK cluster.

Common whitelist configuration errors

• The whitelist on the Whitelist and Security Group > Whitelist Settings page contains only the default entry 127.0.0.1.

  This entry means no external device can access the RDS instance. You must add the IP address of each device that requires access.

• The whitelist is set to 0.0.0.0.

  The correct format is 0.0.0.0/0.

  Important

  The 0.0.0.0/0 entry allows any device to access the RDS instance. Use this setting with caution.

• The public IP address added to the whitelist is not the actual egress IP address of the device.

  This can happen for the following reasons:

  • The public IP address is dynamic and may change.

  • The public IP address returned by an IP address lookup tool or website is inaccurate.

  For a solution, see How do I find the correct public IP address of a local device?.

FAQ

• Q: Do IP whitelist settings take effect immediately?

  A: Whitelist settings take effect in about one minute.

• Q: Why do I see extra whitelists that I did not create?

  A: If the extra whitelists contain internal IP addresses, they are usually generated automatically by other Alibaba Cloud services, such as Data Management (DMS) or Database Autonomy Service (DAS). These whitelists do not affect your business data.

• Q: Are there security risks if I only allow internal network access and do not open my instance to the internet?

  A: Switch your RDS instance to a Virtual Private Cloud (VPC). This ensures that only Elastic Compute Service (ECS) instances within the same VPC can access the RDS instance.

• Q: Why do I get an InvalidSecurityIPListLength.Malformed error when adding a whitelist in the RDS console?

  Problem description

  When you add a whitelist in the RDS console, the following error might occur:

  InvalidSecurityIPListLength.Malformed
  The security IP address is not in the available range or is occupied.

  Solution

  • Cause 1: A single whitelist supports a maximum of 1,000 IP addresses or CIDR blocks. The new IP addresses exceed this limit.

    Solution: Make sure that the number of IP addresses or CIDR blocks in a single whitelist does not exceed 1,000. Consolidate individual IP addresses into CIDR blocks, such as 192.168.1.0/24, to reduce the count.

  • Cause 2: The whitelist contains an invalid IP address.

    Solution: Make sure that the IP addresses are valid. Use the standard CIDR format, such as 10.23.12.0/24, with a mask from 1 to 32. To add multiple IP addresses, separate them with commas (,).

  • Cause 3: The IP address conflicts with an existing whitelist. For example, in RDS for MySQL, 192.168.1.8 conflicts with 192.168.1.1/8.

    Solution: Plan and add whitelists based on your requirements to avoid overlaps or conflicts with existing rules.

  Note

  Do not delete the default whitelist, which contains 127.0.0.1. Do not modify system whitelists, such as ali_dms_group or hdm_security_ips. This can affect system functionality or connection security.