Some data sources use whitelists to restrict access. To allow DataWorks modules such as Data Integration, Data Service, Metadata Collection, and Data Analysis to connect to your data sources, add the egress IP addresses or CIDR blocks of each module to the data source's whitelist.
Background information
The whitelist entries you need depend on the module type:
-
Resource group-dependent modules (such as Data Integration and Data Service): These modules access data sources through the resource group's network. Add the vSwitch CIDR block or public IP address of the resource group to the data source's whitelist.
-
Platform service modules (such as Metadata Collection and Data Analysis): These modules send access requests from DataWorks-managed service nodes outside the resource group's network. Add the platform's predefined IP CIDR blocks to the data source's whitelist to ensure all egress nodes are authorized.
Prerequisites
A network connection must exist between your data source and the resource group. For more information, see Network connectivity solutions.
Obtain whitelist entries
Whitelist for Data Integration
Serverless resource groups
Obtain vSwitch CIDR block
This method applies to data sources that connect to DataWorks over an internal network. Add the vSwitch CIDR block associated with the resource group to your data source's whitelist.
-
Go to the DataWorks resource groups page. In the top navigation bar, select the region where your target resource group is located. Then, find the target resource group in the list.
-
In the Operation column of the target resource group, click Network Settings to open the VPC Binding page.
-
Under Data Scheduling & Data Integration, view the corresponding vSwitch CIDR Block.
-
Add the retrieved vSwitch CIDR block to your data source's whitelist.
Obtain public IP address
This method applies to data sources that connect to DataWorks over the internet. Add the EIP of the resource group to your data source's whitelist.
Serverless resource groups do not have internet access by default. To enable public access to your data source, configure an internet NAT gateway and an EIP for the VPC that is bound to the resource group.
-
Go to the DataWorks resource groups page. In the top navigation bar, select the region where your target resource group is located. Then, find the target resource group in the list.
-
In the Operation column of the target resource group, click Network Settings to open the VPC Binding page.
-
Under Data Scheduling & Data Integration, find the bound VPC and click the
icon next to the VPC name to open its Basic Information page. -
Click the Resource management tab. In the Public Access Service area, click the number under Internet NAT Gateway to view the list of internet NAT gateways created for the VPC.
-
On the internet NAT gateway list page, view the bound EIPs.
-
Add the retrieved EIP address to your data source's whitelist.
Legacy exclusive resource groups
Obtain vSwitch CIDR block
This method applies to data sources that connect to DataWorks over an internal network. Add the vSwitch CIDR block associated with the resource group to your data source's whitelist.
-
Go to the DataWorks resource groups page. In the top navigation bar, select the region where your target resource group is located. Then, find the target resource group in the list.
-
In the Operation column of the target resource group, click Network Settings to open the VPC Binding page.
-
Find the VPC that is bound to the resource group and view its corresponding vSwitch CIDR Block.
-
Add the retrieved vSwitch CIDR block to your data source's whitelist.
Obtain public IP address
This method applies to data sources that connect to DataWorks over the internet. Add the EIP of the resource group to your data source's whitelist.
-
Go to the DataWorks resource groups page. In the top navigation bar, select the region where your target resource group is located. Then, find the target resource group in the list.
-
In the Operation column of the target resource group, click Details to open the resource group details page.
-
Obtain the EIP address.
In the Basic Information section, find the EIP address. If you need to transfer data over the internet, add this EIP to the whitelist of your data source.
-
Add the retrieved EIP address to your data source's whitelist.
Shared resource groups
If you use a shared resource group for Data Integration, add the IP addresses from the whitelist for shared resource groups for Data Integration to your data source's whitelist.
Whitelist for Data Service
Serverless resource groups
Obtain vSwitch CIDR block
This method applies to data sources that connect to DataWorks over an internal network. Add the vSwitch CIDR block associated with the resource group to your data source's whitelist.
-
Go to the DataWorks resource groups page. In the top navigation bar, select the region where your target resource group is located. Then, find the target resource group in the list.
-
In the Operation column of the target resource group, click Network Settings to open the VPC Binding page.
-
Under Data Services, view the corresponding vSwitch CIDR Block.
NoteIf no VPC and vSwitch are bound under the Data Service section, click Add Binding. After the binding is complete, obtain the vSwitch CIDR block.
-
Add the retrieved vSwitch CIDR block to your data source's whitelist.
Obtain public IP address
This method applies to data sources that connect to DataWorks over the internet. Add the EIP of the resource group to your data source's whitelist.
Serverless resource groups do not have internet access by default. To enable public access to your data source, configure an internet NAT gateway and an EIP for the VPC that is bound to the resource group.
-
Go to the DataWorks resource groups page. In the top navigation bar, select the region where your target resource group is located. Then, find the target resource group in the list.
-
In the Operation column of the target resource group, click Network Settings to open the VPC Binding page.
-
Under Data Services, find the bound VPC and click the
icon next to the VPC name to open its Basic Information page. -
Click the Resource management tab. In the Public Access Service area, click the number under Internet NAT Gateway to view the list of internet NAT gateways created for the VPC.
-
On the internet NAT gateway list page, view the bound EIPs.
-
Add the retrieved EIP address to your data source's whitelist.
Legacy exclusive resource groups
Obtain vSwitch CIDR block
This method applies to data sources that connect to DataWorks over an internal network. Add the vSwitch CIDR block associated with the resource group to your data source's whitelist.
-
Go to the DataWorks resource groups page. In the top navigation bar, select the region where your target resource group is located. Then, find the target resource group in the list.
-
In the Operation column of the target resource group, click Details to open the resource group details page.
-
Obtain the name of the vSwitch that is bound to the resource group. Then, go to the VPC console, search for the vSwitch by its name, and obtain its IPv4 CIDR.
-
Add the retrieved vSwitch CIDR block to your data source's whitelist.
Shared resource groups
If you use a shared resource group for Data Service, add the IP addresses from the whitelist for shared resource groups for Data Service to your data source's whitelist.
Whitelist for Metadata Collection
If whitelist-based access control is enabled for the data source used by Metadata Collection, add the IP addresses from the whitelist for Metadata Collection to the data source's whitelist.
Whitelist for Data Analysis
If whitelist-based access control is enabled for the target MaxCompute project used by Data Analysis, add the IP addresses from the whitelist for Data Analysis to the MaxCompute project's whitelist.
Add entries to a whitelist
After you obtain the required whitelist entries, add them to your data source's whitelist. For Alibaba Cloud data sources, refer to the documentation for each service:
-
The following links cover common Alibaba Cloud services. For other services, consult their official documentation.
-
For data sources from other providers, consult their documentation for whitelist configuration.
|
Configure a public whitelist for OpenSearch Vector Search Edition |
|
Related documents
-
For FAQs about network connectivity, see Resource group operations and network connectivity.
-
For frequently asked questions about whitelist entries, see FAQs about adding a whitelist.