Connections and networks - ApsaraDB RDS - Alibaba Cloud Documentation Center

ApsaraDB RDS supports private and public endpoints. Choose the right network access model for your setup — same-VPC, cross-VPC, on-premises, or internet — and lock down access before connecting.

RDS instances run inside an Alibaba Cloud Virtual Private Cloud (VPC). How you connect depends on where your application runs. Choosing the correct endpoint type from the start avoids reconfiguring network rules later.

Connection scenarios

Identify your scenario, then follow the corresponding setup guide.

Scenario	Recommended endpoint	Notes
Application runs in the same VPC as the RDS instance	Private endpoint	Lowest latency; no extra configuration needed if the VPC and subnet already match
Application runs in a different VPC	Private endpoint (via VPC peering)	Set up a VPC peering connection first, then use the private endpoint
On-premises application via dedicated connection	Private endpoint (via Express Connect or VPN Gateway)	Requires a VPN Gateway or Express Connect circuit between your data center and the VPC
Application connects over the internet	Public endpoint	Enable the public endpoint on the instance; restrict access with an IP whitelist

Warning

Enabling a public endpoint exposes your instance to the internet. Always configure an IP whitelist to restrict access to known IP addresses. Disable the public endpoint when it is no longer needed.

Endpoint types

Each RDS instance can have up to two endpoints active at the same time: one private endpoint and one public endpoint.

Private endpoint

The private endpoint is created automatically when you create an instance. It is accessible only within the VPC (or through a peered network or dedicated connection). Use the private endpoint for production workloads — it delivers lower latency and avoids data transfer costs over the public network.

Public endpoint

The public endpoint is disabled by default. Enable it only when your application must connect from outside Alibaba Cloud. After enabling it, add the application's IP addresses to the IP whitelist before testing connectivity.

Network access control

RDS uses two layers of access control:

IP whitelist — Controls which IP addresses can reach the instance. Every instance has a default group. Add your application server IPs before the first connection attempt.
Security group — An Elastic Compute Service (ECS) security group can be bound to an RDS instance to apply additional inbound rules. Security group rules take effect alongside the IP whitelist.

Important
Enabling a private endpoint does not automatically disable the public endpoint. If your security requirements prohibit public access, disable the public endpoint explicitly after private connectivity is confirmed.

Authentication methods

RDS supports the following authentication methods. Choose the one that matches your organization's identity infrastructure.

Database account and password — The most common method. Create a database account in the RDS console and use the username and password in your connection string.
SSL/TLS encryption — Encrypts the connection between your application and the RDS instance. Enable SSL/TLS on the instance, download the CA certificate, and configure your client to verify server identity. This method is compatible with all authentication options listed here.
Kerberos authentication — Available for RDS SQL Server instances joined to a Microsoft Active Directory domain. Requires an Active Directory connector configured in the Alibaba Cloud console.

Database proxy and connection pooling

For applications that open many short-lived database connections, use the RDS database proxy. The proxy instance sits between your application and the RDS primary instance and maintains a persistent connection pool, reducing connection overhead and smoothing traffic spikes.

Key behaviors of the proxy instance:

Exposes a dedicated proxy endpoint separate from the primary instance endpoint.
Supports read/write splitting: write requests go to the primary instance, read requests are distributed to read-only instances.
Maintains connections to the RDS instance even when your application disconnects and reconnects frequently.

Apply for a public endpoint
Configure an IP whitelist
Set up VPC peering for cross-VPC access
Enable SSL/TLS encryption
Create and use a database proxy instance