Cross-engine whitelist templates

Scenarios

When multiple database instances of different engine types require the same IP address whitelist, you can create a single whitelist template and associate it with these instances. To adjust the whitelist, update the template. Changes automatically take effect on all associated instances.

Prerequisites

• The database engine must be one of the following:

  ApsaraDB RDS for MySQL, ApsaraDB RDS for PostgreSQL, PolarDB for MySQL, PolarDB for PostgreSQL, and Tair (Redis OSS-compatible).

• The database instance must be in one of the following regions:

  China (Hangzhou), China (Shanghai), China (Nantong), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), China (Hong Kong), Japan (Tokyo), UK (London), US (Virginia), US (Silicon Valley), Singapore, Philippines (Manila), Thailand (Bangkok), Germany (Frankfurt), UAE (Dubai), Malaysia (Kuala Lumpur), Indonesia (Jakarta), and South Korea (Seoul).

Limits

• A whitelist template can contain up to 1,000 whitelist rules. Each rule can be a specific IP address or a CIDR block. Modifications to the IP address whitelist or template associations fail if this limit is exceeded.

• A whitelist template can be associated with up to 500 instances.

• You can create up to 100 whitelist templates per region. To request a quota increase, join the DingTalk group by searching for the group number 58255008752 and submit your request.

• An instance can be associated with multiple IP address whitelist templates, as long as they are all in the same region.

Notes

• Whitelist template changes take effect immediately, but updates to the IP address whitelists of associated instances take about one minute to propagate.

• If a whitelist template is associated with multiple instances, modifying it affects all of them. Assess the potential impact before making changes.

• Deleting a whitelist template removes its rules from all associated instances, which may disrupt active connections. To avoid this, disassociate the instances before deleting the template.

• Cross-engine whitelist templates configured in DAS do not appear in the consoles of associated ApsaraDB RDS and Tair instances.

Procedure

1. Log on to the DAS console.

2. In the left-side navigation pane, choose Security Center > Global Security Management.

3. On the Global Security Management page, click the Whitelist Template tab.

   • Create a whitelist template: Click Create IP Whitelist Template. In the panel that appears, enter a Whitelist Template Name and the IP Addresses in Whitelist, select a Region, and then click OK.

     Note

     • Setting the IP address whitelist to 0.0.0.0/0 allows access from any IP address on the internet. Exercise caution with this setting.

     • If you set the IP address whitelist to only 127.0.0.1, all external access is denied. If other IP addresses or CIDR blocks are also configured, the 127.0.0.1 entry is ignored.

     • A newly created whitelist template takes effect in about one minute.

   • Modify a whitelist template: Find the target whitelist template and click Modify in the Actions column. In the panel that appears, modify the whitelist template name and edit the IP addresses or CIDR blocks in the template, and then click OK.

     Important

     Modifying a whitelist template applies the changes to all its associated instances.

   • Associate or disassociate instances: Find the target whitelist template and click Associate Instance in the Actions column. In the panel that appears, perform the following operations, and then click OK.

     1. Select the desired product type. You can click the RDS, PolarDB, Tair, or MongoDB tab to switch between product types.

     2. After you select a product, select the engine type. The supported engine types include ApsaraDB RDS for MySQL and ApsaraDB RDS for PostgreSQL.

     3. In the All Instances section on the left, you can search for instances and associate them in bulk. After selection, the instances to be associated are displayed under Change Overview > Instances to Be Associated.

        Note

        To disassociate an instance, deselect it. The deselected instances are displayed under Change Overview > Instances to Be Disassociated. On the Change Overview page, if the number of Instances to Be Associated is 0 and the number of Instances to Be Disassociated is 5, the instances to be disassociated are displayed as tags in the format RDS: rm-<Instance ID>.

   • Delete a whitelist template: Find the target whitelist template and click Delete in the Actions column. In the confirmation dialog box that appears, click Confirm.

     Important

     • Deleting a whitelist template disassociates it from all related instances and removes its rules from them. This operation does not affect the instances' original whitelists or other associated whitelist templates.

     • If an instance is associated with multiple templates that contain duplicate whitelist entries, deleting one of the templates does not remove the duplicate entries from the instance's whitelist.