By default, ApsaraDB RDS for PostgreSQL provides an internal endpoint for connections within the same virtual private cloud (VPC). If your application runs outside that VPC—on an Elastic Compute Service (ECS) instance in a different VPC, on an on-premises device, or on the Internet—apply for a public endpoint to establish connectivity.
When you need a public endpoint
Use a public endpoint in these scenarios:
Cross-VPC access: Your application runs on an ECS instance in a different VPC from your RDS instance.
External access: Your application runs on an on-premises device or elsewhere on the Internet.
If the ECS instance and the RDS instance are in the same VPC, use the internal endpoint instead—it offers better performance and security.
Endpoint types
| Endpoint type | Description |
|---|---|
| Internal endpoint | Provided by default. Cannot be released. You can change the network type of the instance. For security and performance, we recommend using the internal endpoint whenever possible. |
| Public endpoint | Must be applied for manually. Can be released when no longer needed. Required when connecting from an ECS instance in a different VPC or from a device outside Alibaba Cloud. |
Applying for a public endpoint and the resulting Internet traffic are both free of charge. However, exposing your instance to the Internet increases security risk. For faster transmission and higher security, we recommend migrating your application to an ECS instance that resides in the same region and has the same network type as the RDS instance so that you can connect using the internal endpoint.
Enable or disable the public endpoint
Go to the Instances page. In the top navigation bar, select the region where your RDS instance resides. Then click the instance ID.
In the left navigation pane, click Database Connection.
Enable or disable the public endpoint:
To enable: click Apply for Public Endpoint.
To disable: click Disable Public Endpoint.
WarningWhen you enable a public endpoint, the system adds
0.0.0.0/0to the IP address whitelist by default. This CIDR block allows access from any IP address. Use this setting for testing only—do not use0.0.0.0/0on a production instance.In the confirmation dialog box, click OK.
What's next
After the public endpoint is enabled, configure access control and connect to your instance:
Add your client's IP address to the whitelist. Add the public IP address of your client or application to an IP address whitelist on your RDS instance. Without this step, connections from the public endpoint will be blocked. For details, see Configure an IP address whitelist.
Connect to your instance. Use pgAdmin, the PostgreSQL CLI, or your application to connect. For details, see Connect to an ApsaraDB RDS for PostgreSQL instance.
API reference
Use the following API operations to manage the public endpoint programmatically:
| API | Description |
|---|---|
| AllocateInstancePublicConnection | Applies for a public endpoint for an instance. |
| ReleaseInstancePublicConnection | Releases the public endpoint of an instance. |