Configure an IP address whitelist for an ApsaraDB RDS for SQL Server instance - ApsaraDB RDS

By default, a new ApsaraDB RDS for SQL Server instance denies access from external devices. For security, you must configure an IP address whitelist to allow access only from trusted IP addresses. For enhanced security, configure and regularly maintain the IP address whitelist immediately after you create an instance. Configuring an IP address whitelist does not affect the normal operation of the RDS instance.

To configure an IP address whitelist for other database engines, see the following topics:

Use cases

Common scenarios for configuring an IP address whitelist:

After you create an RDS instance, you must add the IP addresses of external devices to the IP address whitelist to enable access.
If a database connection fails, check whether the IP address whitelist is configured correctly.

The following table describes the IP address whitelist configurations for different connection scenarios.

Connection scenario	Network type	Whitelist configuration
Connect from an ECS instance to an RDS instance	In the same Virtual Private Cloud (VPC) (recommended)	Add the private IP address of the ECS instance.
Connect from an ECS instance to an RDS instance	In different VPCs	Instances in different VPCs cannot communicate over an internal network. You can move the two instances to the same VPC and then add the private IP address of the ECS instance to the IP address whitelist.
Connect from a container in an ACK cluster to an RDS instance	In the same Virtual Private Cloud (VPC) (recommended)	If the container network plugin of the ACK cluster is Flannel, add the IP address of the application's node. If the container network plugin of the ACK cluster is Terway, add the IP address of the application's pod. You can find the pod IP address and node IP address on the pod page of the target ACK cluster.
	In different VPCs	Instances in different VPCs cannot communicate over an internal network. You can move the two instances to the same VPC and then add the required IP address from the ACK cluster to the IP address whitelist. If the container network plugin of the ACK cluster is Flannel, add the IP address of the application's node. If the container network plugin of the ACK cluster is Terway, add the IP address of the application's pod.
Connect from an on-premises host to an RDS instance	N/A	Add the public IP address of the on-premises host to the IP address whitelist. Note The application on the on-premises host must use the public endpoint of the RDS instance.

Usage notes

Each instance supports up to 50 IP address whitelist groups.
The default IP address whitelist group, named default, cannot be deleted, but it can be cleared. The default entry in this group is 127.0.0.1, which prevents any external device from accessing the RDS instance.
Do not modify or delete system-generated groups, such as ali_dms_group (the IP address whitelist group for Data Management (DMS)) and hdm_security_ips (the IP address whitelist group for DAS). Otherwise, related services may not work as expected.

Important
To prevent accidental modification or deletion, the hdm_security_ips whitelist group is not visible to users for instances created after December 2020.

Procedure

Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
In the left-side navigation pane, click Whitelist and SecGroup.

On the Whitelist Settings tab, you can view the current IP address whitelist mode.

Note
Instances that were created previously may use enhanced whitelist mode. All new instances use standard whitelist mode.
Click Create Whitelist, enter a Group Name, add the IP addresses of the application server to the whitelist, and then click OK.
Note
- You can also click Modify to the right of the default group to change the IP addresses in that group.
- Use a comma (,) to separate multiple IP addresses. Do not add spaces before or after the comma. For example: 192.XXX.XXX.1,172.XXX.XXX.9.
- A single instance supports a maximum of 1,000 IP addresses or CIDR blocks. If you need to add a large number of IP addresses, merge them into CIDR blocks, such as 10.10.10.0/24.
- No additional considerations are required for the standard whitelist mode. If the instance uses the enhanced whitelist mode, note the following:
  - Add public IP addresses or private IP addresses of ECS instances in the classic network to a classic network group.
  - Add private IP addresses of ECS instances in a VPC to a VPC group.
(Optional) In the Create Whitelist dialog box, click Add Internal IP Address of ECS Instance to add the IP addresses of all your ECS instances to the whitelist. In the IP Addresses in Group section, select the desired IP addresses from the Not Set list. Then, click the right arrow (>) to move them to the Set list and click OK.

Next steps

Connect to an ApsaraDB RDS for SQL Server instance

Appendix: Finding application server IP addresses

Identify your connection scenario, obtain the correct IP address, and add it to the IP address whitelist.

Scenario	Required IP address	Method
When connecting over an internal network	IP address of the ACK container	If the container network plugin of the ACK cluster is Flannel, add the IP address of the application's node. If the container network plugin of the ACK cluster is Terway, add the IP address of the application's pod. You can find the pod IP address and node IP address on the pod page of the target ACK cluster.
When connecting over an internal network	Private IP address of an ECS instance	Go to the ECS Instances page. In the top navigation bar, select the region where the instance is located. You can view the private and public IP addresses in the instance list.
Connecting from an ECS instance over the public network	Public IP address of an ECS instance
Connecting from a local device	Public IP address of the local device	On your local device, search for 'my IP address'. Note If the IP address obtained by this method is inaccurate, use other methods to obtain it.

FAQ

Why do I receive the InvalidSecurityIPListLength.Malformed error when I add an IP address to a whitelist in the ApsaraDB RDS console?

Problem description

When you add an IP address to a whitelist in the ApsaraDB RDS console, you may receive the following error:

InvalidSecurityIPListLength.Malformed
The security ip address is not in the available range or occupied.

Solution

Cause 1: The number of IP addresses or CIDR blocks in a single whitelist group exceeds the limit of 1,000.

Solution: Ensure that the number of IP addresses or IP ranges in a single whitelist group does not exceed 1,000. We recommend that you merge scattered IP addresses into CIDR blocks, such as 192.168.1.0/24, to reduce the number of entries.
Cause 2: The IP address whitelist contains an invalid IP address.

Solution: Enter a valid IP address in the standard CIDR format, such as 10.23.12.0/24. The subnet mask must be in the range of 1 to 32. To add multiple IP addresses, separate them with a comma (,).
Reason 3: A conflict exists with an entry in the allowlist. For example, in RDS for MySQL, 192.168.1.8 conflicts with 192.168.1.1/8.

Solution: Plan IP addresses to prevent overlaps and conflicts with existing rules.

Note

Do not delete the default group default (containing 127.0.0.1) or modify system groups such as ali_dms_group or hdm_security_ips, to avoid affecting system functionality or connection security.

ApsaraDB RDS:Configure an IP address whitelist