Standard whitelist mode applies a single IP address whitelist to all connections regardless of network type, which prevents per-network access control. Enhanced whitelist mode binds each whitelist to a specific network type—VPC or classic network—so you can enforce access control independently for each network path.
Prerequisites
Before you begin, ensure that you have:
-
An ApsaraDB RDS for PostgreSQL instance running one of the following:
PostgreSQL 10 on RDS High-availability Edition with Premium Local SSDs
PostgreSQL 9.4 on RDS High-availability Edition with Premium Local SSDs
Usage notes
This switch is irreversible. Once you switch to enhanced whitelist mode, the instance cannot revert to standard whitelist mode.
In enhanced whitelist mode, the classic-network-type IP address whitelist controls both classic network access and Internet access. To allow Internet access to the RDS instance, add the host's public IP address to a classic-network-type whitelist.
The switch takes approximately 3 minutes. The application stays connected to the RDS instance during this period.
After you switch to enhanced whitelist mode, the Elastic Compute Service (ECS) security group configuration remains unchanged. For more information, see Configure an IP address whitelist for an ApsaraDB RDS for PostgreSQL instance.
What changes after switching
The switch automatically creates network-type-specific whitelists based on the instance's current network configuration:
|
Network configuration |
Result |
|
VPC |
A VPC-type IP address whitelist is created. All IP addresses and CIDR blocks from the original whitelists are copied to it. |
|
Classic network |
A classic-network-type IP address whitelist is created. All IP addresses and CIDR blocks from the original whitelists are copied to it. |
|
Hybrid access mode |
Two IP address whitelists are created: one VPC-type and one classic-network-type. Both contain all IP addresses and CIDR blocks from the original whitelists. For more information, see Configure the hybrid access solution for an ApsaraDB RDS for PostgreSQL instance. |
Procedure
Go to the Instances page. In the top navigation bar, select the region where the RDS instance resides. Find the instance and click its ID.
In the left-side navigation pane, click Whitelist and SecGroup.
On the Whitelist Settings tab, click Switch to Enhanced Whitelist (Recommended).
In the confirmation message, click Confirm.
FAQ
How do I allow Internet access to my RDS instance in enhanced whitelist mode?
Add the host's public IP address to a classic-network-type IP address whitelist. In enhanced whitelist mode, the classic-network-type whitelist governs both classic network and Internet access.
What is the advantage of enhanced whitelist mode over standard whitelist mode?
Standard mode applies a single whitelist to all connections regardless of network type. Enhanced mode scopes each whitelist to a specific network type, so an IP address in a VPC-type whitelist grants access only over that VPC—not over the Internet or classic network.