ApsaraDB for SelectDB blocks all incoming connections by default. To allow your application servers, workstations, or other clients to connect, add their IP addresses or Classless Inter-Domain Routing (CIDR) blocks to an instance whitelist.
Before you begin
Collect all IP addresses that need access before you start. Consider:
Application servers and backend services
Developer workstations
VPN exit nodes and remote access points
On-call or rotating access locations
If a client is behind a corporate NAT gateway, its outbound IP may differ from its local address. Use an IP lookup service such as whatsmyip to find the actual originating IP.
Usage notes
The default whitelist group (
default) cannot be deleted. It initially contains only127.0.0.1. You can modify or remove IP addresses within it, but the group itself is permanent.An instance supports up to 200 IP addresses and CIDR blocks across all whitelist groups combined.
A single whitelist group supports up to 50 IP addresses and CIDR blocks.
Changes take about one minute to propagate. If a connection attempt fails immediately after an update, wait one minute and retry before further troubleshooting.
Configuring a whitelist does not affect the normal operation of an ApsaraDB for SelectDB instance.
After you configure a whitelist, IP addresses in the whitelist can also access related APIs for the instance. For more information, see Open API Overview.OPENAPI OVERVIEW
Do not add 0.0.0.0/0 unless absolutely necessary. Adding this entry allows all IP addresses to access the instance, which creates a high security risk and can lead to unauthorized access. Use this setting with caution and remove it as soon as it is no longer needed.
Add IP addresses to the whitelist
Log on to the ApsaraDB for SelectDB console.
In the upper-left corner, select the region where the instance is located.
On the Instance List page, click the instance ID in the Instance ID column.
On the Instance Details page, click Data Security in the left navigation pane.
On the whitelist group page, click Modify in the Actions column for the default group.
To create a separate group instead, click Create Whitelist Group and set the Group Name and Whitelist fields. Use separate groups to organize access by team or environment.
In the Modify Whitelist Group panel, enter the IP addresses or CIDR blocks to allow.
Click OK.
The updated addresses appear on the whitelist group page. Allow about one minute for the changes to take effect before testing connectivity.