ApsaraDB RDS:Configure IP address whitelist

Procedure

1. Visit the RDS instance list, select a region at the top, and then click the target instance ID.

2. In the left-side navigation pane, click Whitelist And SecGroup.

3. Confirm the IP address whitelist mode.

   Note

   Instances running MySQL 5.5, 5.6, or 5.7 on local SSDs can be switched to enhanced security mode. Other instances use standard mode.

4. Click Modify to the right of the default group, and in the dialog box that appears, add IP addresses to the whitelist.

   Note

   • If needed, you can also click Create Whitelist and specify a custom group name.

   • Groups serve only for IP address management and do not affect access permissions. IP addresses in all groups have the same access permissions to the RDS instance.

   • Method 1: Add the IP address of your application server to the IP Addresses field. To view the IP address of your application server, see Appendix: How to obtain IP addresses. You can also click Load Local Public IP Address (If there is a network proxy on your PC, please turn it off first) to directly add the public IP address of your computer.

     Note

     • To add multiple IP addresses and CIDR blocks, separate them with commas (,). Do not add spaces before or after the commas.

     • Each RDS instance supports a maximum of 1,000 IP addresses and CIDR blocks in total. To reduce the number of entries, we recommend that you merge IP addresses into CIDR blocks, such as 10.10.10.0/24.

     • If the whitelist mode is enhanced security mode, note the following:

       • Add public IP addresses to the Classic Network group.

       • Add the private IP addresses of ECS instances in VPCs to the VPC group.

   • Method 2: Click Add Internal IP Address of ECS Instance to display the IP addresses of all ECS instances under your Alibaba Cloud account in the current region. You can then add these IP addresses to the whitelist.

   Your application server can access the RDS instance only after you add its IP address to a whitelist of the RDS instance.

5. Click OK.

What to do next

Connect to an ApsaraDB RDS for MySQL instance using the command line or a client

References

• API: ModifySecurityIps

• API: DescribeDBInstanceIPArrayList

• For other engines, see the following:

  • Configure an IP address whitelist for an ApsaraDB RDS for SQL Server instance

  • Configure an IP whitelist

  • Configure an IP address whitelist for an ApsaraDB RDS for MariaDB instance

FAQ

• Q: Why can IP addresses that are not added to the whitelist access my RDS instance?

  A: You can troubleshoot the issue using the following methods:

  • Check all whitelist groups for the entry 0.0.0.0/0. This entry allows all IP addresses to access the RDS instance, which poses a security risk. We recommend that you remove it and add only trusted IP addresses.

  • Check all security groups for the IP address. If a security group includes it, that IP address can access the RDS instance.

• Q: How can I access an RDS instance from my computer without enabling Internet access?

  A: You need to establish an internal network connection. For more information, see Connect a VPC to an on-premises data center, office terminal, or other cloud.

• Q: The IP address of my application changes frequently and is not fixed. How should I configure the whitelist for my RDS database in this case?

  A: If you do not have a fixed IP address, avoid setting 0.0.0.0/0 (which allows all IP addresses to access the RDS instance). Instead, consider identity-based access control rather than IP-based access control. For example:

  • Use a dynamic DNS service: Obtain a domain name for the dynamic IP address and add the domain name or its resolved IP address to the whitelist.

  • Set up a reverse proxy or Server Load Balancer: Route all application requests to the database through a reverse proxy server or Server Load Balancer, and add only the fixed IP address of the proxy server to the whitelist.

  • Update the whitelist regularly: For IP addresses that change within a predictable range (such as ISP-assigned home broadband addresses), periodically obtain and update them in the whitelist.

• Q: Why do I receive an error InvalidSecurityIPListLength.Malformed when adding a whitelist through the RDS console?

  Issue description

  When adding a whitelist through the RDS console, you might encounter the following error:

  Error code: InvalidSecurityIPListLength.Malformed
  Error message: The security IP address is not in the available range or is occupied.

  Solution

  • Cause 1: A single whitelist group supports a maximum of 1,000 IP addresses or CIDR blocks, and the new entry exceeds this limit.

    Solution: Keep the number of entries in a single whitelist group within 1,000. We recommend that you merge scattered IP addresses into CIDR format (such as 192.168.1.0/24) to reduce the number of entries.

  • Cause 2: The IP address whitelist contains invalid addresses.

    Solution: Verify that all IP addresses are valid. We recommend that you use the standard CIDR format (such as 10.23.12.0/24) with a mask range of 1 to 32. Separate multiple IP addresses with commas (,).

  • Cause 3: There is a conflict with existing whitelist entries. For example, in ApsaraDB RDS for MySQL, 192.168.1.8 conflicts with 192.168.1.1/8.

    Solution: Plan whitelist entries based on your actual needs to avoid overlaps or conflicts with existing rules.

  Note

  Do not delete the default group default, which contains 127.0.0.1, and do not modify system groups, such as ali_dms_group or hdm_security_ips, to avoid affecting system functionality or connection security.

Appendix: Check whether your application can connect to the RDS instance over an internal network

1. View the region and network type of the ECS instance on which your application is deployed. For more information, see Get ready to use ApsaraDB RDS.

2. View the region and network type of the RDS instance.

   Log on to the ApsaraDB RDS console and go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance. On the page that appears, you can view the region, network type, and VPC ID of the RDS instance.

3. Check whether the ECS instance and the RDS instance meet the following conditions for communication over an internal network:

   1. The ECS instance and the RDS instance reside in the same region.

   2. The ECS instance and the RDS instance reside in the same type of network. If the ECS instance and the RDS instance both reside in VPCs, these instances reside in the same VPC.

   Note

   If one of the preceding conditions is not met, the ECS instance cannot communicate with the RDS instance over an internal network.

Appendix: How to obtain IP addresses

Appendix: System whitelists

When DMS, DTS, and DAS services interact with ApsaraDB RDS for MySQL, the system automatically adds the following whitelist groups to ensure normal access.