ApsaraDB RDS:Configure a whitelist

Precautions

• You can modify or clear the entries in the default whitelist, but you cannot delete the whitelist group itself.

• An instance supports a maximum of 50 whitelist groups.

• You can add up to 1,000 IP addresses or IP address ranges to a single instance. We recommend consolidating scattered IP addresses into IP address ranges, such as 10.10.10.0/24 (CIDR notation).

• Whitelist groups such as ali_dms_group (for Data Management (DMS)) and hdm_security_ips (for Database Autonomy Service (DAS)) are automatically generated by the system. Do not modify or delete these groups. Otherwise, the related services may not work correctly.

  Important

  • Do not add your application's IP addresses to these system-generated groups. Service updates might overwrite your entries and cause business interruptions.

  • To prevent accidental modification or deletion, the hdm_security_ips whitelist group is hidden from the console for instances created after December 2020.

Configure an IP whitelist

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Whitelist and SecGroup.

3. On the Whitelist Settings tab, find the default whitelist group and click Modify .

   Note

   You can also click Create Whitelist to create a custom group.

4. In the Modify Whitelist dialog box, enter the IP addresses or IP address ranges to allow, and then click OK.

   Note

   • When you add a new IP address or IP address range to the default group, the system automatically removes the default entry 127.0.0.1.

   • To add multiple IP addresses or IP address ranges, separate them with a comma without any spaces. For example: 192.168.0.1,172.16.213.9.

   • Click Add Internal IP Addresses of ECS Instances to display the IP addresses of all ECS instances under your Alibaba Cloud account. This lets you quickly add the internal IP addresses of your ECS instances to the whitelist.

   • If your application is deployed in a container within an ACK cluster, you must add different IP addresses depending on the container network plugin.

     • If the ACK cluster uses the Flannel plugin, add the node IP address where the application is running.

     • If the ACK cluster uses the Terway plugin, add the pod IP address where the application is running.

     You can find the pod IP and node IP on the Pods page of the target ACK cluster.

Common whitelist configuration errors

• Only the default address 127.0.0.1 is on the whitelist.

  This entry blocks all external access to the RDS instance. You must add the client's IP address to the whitelist.

• The whitelist is set to 0.0.0.0.

  The correct format is 0.0.0.0/0.

  Important

  The entry 0.0.0.0/0 allows access from any device. Use this entry with caution.

• The public IP address added to the whitelist is not the device's actual egress IP.

  This happens for the following reasons:

  • The public IP address is dynamic and has changed.

  • The public IP address provided by an IP lookup tool or website is inaccurate.

  For a solution, see Cannot connect to an RDS for MySQL or MariaDB instance over the internet: How to correctly specify the public IP address of a local device.

FAQ

• Q: Do whitelist changes take effect immediately?

  A: The changes take effect in about one minute.

• Q: Why do I see whitelist groups that I did not create?

  A: If the extra groups contain internal IP addresses, they are typically generated automatically by other Alibaba Cloud services, such as DMS or DAS. These services do not access your business data.

• Q: If I don't enable public access and only use internal access, are there still security risks?

  A: We recommend placing your RDS instance in a VPC. A VPC ensures that only ECS instances within it can access the RDS instance.

• Q: Why do I receive an InvalidSecurityIPListLength.Malformed error when adding a whitelist in the RDS console?

  Problem

  When adding IP addresses to a whitelist in the RDS console, you might see the following error:

  InvalidSecurityIPListLength.Malformed
  The security ip address is not in the available range or occupied.

  Solutions

  • Cause 1: A single whitelist group supports a maximum of 1,000 IP addresses or IP address ranges, and the new entry exceeds this limit.

    Solution: Ensure that a single whitelist group contains no more than 1,000 IP addresses or IP address ranges. You can consolidate individual IP addresses into IP address ranges in CIDR format (such as 192.168.1.0/24) to reduce the number of entries.

  • Cause 2: The whitelist contains an invalid IP address.

    Solution: Enter the IP address in standard CIDR format, such as 10.23.12.0/24, with a mask range of 1 to 32. If you need to add multiple IP addresses, use a comma (,) to separate them.

  • Reason 3: A conflict exists with an existing whitelist. For example, in RDS MySQL, 192.168.1.8 conflicts with 192.168.1.1/8.

    Solution: Plan and add whitelist entries based on your actual requirements to avoid overlaps or conflicts with existing rules.

  Note

  Do not delete the default group default (which contains 127.0.0.1) or modify system groups such as ali_dms_group or hdm_security_ips to avoid affecting system functionality or connection security.