To ensure transaction consistency and isolation, you can configure a distributed transaction whitelist for your ApsaraDB RDS for SQL Server instances. You can configure a whitelist to specify which Elastic Compute Service (ECS) instances are allowed to participate in distributed transactions of RDS instances. This improves system security and stability and facilitates troubleshooting of transaction consistency issues. This topic describes how to configure a distributed transaction whitelist for an RDS instance.
The RDS instance meets the following requirements:
The RDS instance runs SQL Server 2022 EE (Always On), SQL Server 2019 EE (Always On), SQL Server 2017 EE (Always On), SQL Server 2016 EE, SQL Server 2012 EE, SQL Server 2022 SE, SQL Server 2019 SE, SQL Server 2017 SE, SQL Server 2016 SE, SQL Server 2012 SE, or SQL Server 2008 R2 with cloud disks.
The RDS instance runs RDS High-availability Edition or RDS Cluster Edition.
The RDS instance belongs to the general-purpose or dedicated instance family. The shared instance family is not supported.
You can go to the Basic Information page of your RDS instance to view the preceding information.
Configure the RDS instance
- Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
In the left-side navigation pane of the page that appears, click Whitelist and SecGroup. On the Whitelist Settings tab of the page that appears, click Modify to the right of the IP address whitelist that is labeled
defaultand add the IP address of the ECS instance to the whitelist.Note
If the ECS instance and RDS instance reside in the same virtual private cloud (VPC), you must enter the private IP address of the ECS instance. You can view the private IP address of the ECS instance on the Instance Details page of the ECS instance in the ECS console.
If the ECS instance and RDS instance reside in different VPCs, you must enter the public IP address of the ECS instance. In addition, you must apply for a public endpoint for the RDS instance. For more information, see Apply for or release a public endpoint.
In the left-side navigation pane, click Data Security. On the page that appears, click the Distributed Transaction Whitelist tab.
Click Create Whitelist. In the dialog box that appears, configure the following parameters and click OK.
Enter a name for the whitelist. The name must be 2 to 32 characters in length. The name can contain digits, lowercase letters, and underscores (_). The name must start with a lowercase letter and end with a lowercase letter or digit.
Enter the IP address of the ECS instance and the name of the Windows computer on which the ECS instance resides. Separate the IP address and the computer name with a comma (,). Example: 192.168.1.100,k3ecstest.
If you want to enter more than one entry, make sure that each entry is in a different line.Note
To view the computer name, open.
Configure the ECS instance
Log on to the ECS console.
In the left-side navigation pane, choose.
In the top navigation bar, select the region in which the instance resides.
Find the ECS instance and click the instance ID.
In the top navigation bar, click Security Groups.
Find the security group that you want to manage and click Configure Rules in the Actions column.
On the Inbound tab, click Add Rule.
Configure the parameters and then click Save. The following table describes the parameters.
Retain the default value 1.
Select Custom TCP.
Port 135 is the fixed port for the Remote Procedure Call (RPC) service.
Enter the two IP addresses of the RDS instance in the Authorization Object field. You can view these IP addresses on thetab of the Data Security page.
Enter a description. The description must be 2 to 256 characters in length, and cannot start with
Create another security group rule. This rule has the same parameter settings as the previous rule except for the Port Range parameter. Set the Port Range parameter to 1024/65535.
For more information about the related best practices, see Connect Kingdee K/3 WISE to an ApsaraDB RDS for SQL Server instance.
For more information about how to configure a whitelist, see Configure an IP address whitelist.
For more information about the terms, limits, and best practices of security groups, see Overview.