To ensure transaction consistency and isolation, you can configure a distributed transaction whitelist for your ApsaraDB RDS for SQL Server instance. You can configure a distributed transaction whitelist for your RDS instance to allow for distributed transactions between specific Elastic Compute Service (ECS) instances and the RDS instance. Then, you can adjust the security group rules of the ECS instances to ensure that the network configurations for the ECS instances match the whitelist settings of the RDS instance. This helps build a secure and stable distributed transaction environment to facilitate troubleshooting of transaction consistency issues.
Prerequisites
The RDS instance meets the following requirements:
The RDS instance runs SQL Server 2022 EE (Always On), SQL Server 2019 EE (Always On), SQL Server 2017 EE (Always On), SQL Server 2016 EE, SQL Server 2012 EE, SQL Server 2022 SE, SQL Server 2019 SE, SQL Server 2017 SE, SQL Server 2016 SE, SQL Server 2012 SE, or SQL Server 2008 R2 with cloud disks.
The RDS instance belongs to the general-purpose or dedicated instance family. The shared instance family is not supported.
You can go to the Basic Information page of your RDS instance to obtain the preceding information.
Configure the RDS instance
Step 1: Configure a whitelist
Configure a whitelist for your RDS instance to allow access from the IP address of a specific ECS instance to the RDS instance.
- Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
In the left-side navigation pane, click Whitelist and SecGroup. On the Whitelist Settings tab of the page that appears, click Modify to the right of the IP address whitelist that is labeled
defaultand add the IP address of the ECS instance to the whitelist.NoteIf the ECS instance and RDS instance reside in the same virtual private cloud (VPC), you must enter the private IP address of the ECS instance.
If the ECS instance and RDS instance reside in different VPCs, you must enter the public IP address of the ECS instance. In addition, you must apply for a public endpoint for the RDS instance. For more information, see Apply for or release a public endpoint.
You can view the private or public IP address of the ECS instance on the Instance Details page of the ECS instance in the ECS console. For more information, see View IP addresses.
The following figure shows the page that displays the IP addresses of an ECS instance.
Click OK.
Step 2: Configure a distributed transaction whitelist
Configure a distributed transaction whitelist to specify which ECS instances are allowed to participate in handling distributed transactions of the RDS instance by computer name.
In the left-side navigation pane, click Data Security. On the page that appears, click the Distributed Transaction Whitelist tab.
Click Create Whitelist. In the dialog box that appears, configure the following parameters and click OK.
Parameter
Description
Whitelist Name:
Enter a name for the whitelist. The name must be 2 to 32 characters in length. The name can contain digits, lowercase letters, and underscores (_). The name must start with a lowercase letter and end with a lowercase letter or digit.
IP Addresses
Enter a value in the format of
IP address of the ECS instance,Hostname. The IP address and the hostname are separated with a comma (,). The hostname refers to the name of the Windows computer on which the ECS instance resides. Example:192.168.1.100,k3ecstest. If you want to enter more than one entry, make sure that each entry is in a different line.To view the computer name that is specified by the Hostname parameter, open Control Panel of your computer and choose .
Configure the ECS instance
Adjust the security group rules of the specified ECS instance and enable the required port to ensure that the network configurations for the ECS instance match the whitelist settings of the RDS instance. This helps build a secure distributed transaction environment.
Log on to the ECS console.
In the left-side navigation pane, choose .
In the top navigation bar, select the region in which the ECS instance resides.
Find the ECS instance and click the instance ID.
In the top navigation bar, click Security Groups.
Find the security group that you want to manage and click Manage Rules in the Actions column.
On the Inbound tab, click Add Rule.
Configure the required parameters and then click Save. The following table describes the parameters.
Parameter
Description
Action
Select Allow.
Priority
Retain the default value 1.
Protocol Type
Select Custom TCP.
Port Range
Enter 135.
NotePort 135 is the fixed port for the Remote Procedure Call (RPC) service.
Authorization object
Enter the two IP addresses of the RDS instance in the Authorization Object field. You can view these IP addresses on the Distributed Transaction Whitelist tab of the Data Security page. The IP addresses are the IP addresses of the underlying ECS instance on which the RDS instance is deployed.
NoteYou can also call the DescribeDBInstanceIpHostname operation to query the IP addresses.
Description
Enter a description. The description must be 2 to 256 characters in length, and cannot start with
http://orhttps://.Create another security group rule. This rule has the same parameter settings as the previous rule except for the Port Range parameter. Set the Port Range parameter to 1024/65535.
References
For more information about the related best practices, see Connect Kingdee K/3 WISE to an ApsaraDB RDS for SQL Server instance.
For more information about how to configure a whitelist, see Configure an IP address whitelist.
For more information about the terms, limits, and best practices of security groups, see Overview.