Network access and security settings

Network access types

Milvus supports VPC access and public access. A Milvus instance does not have a dedicated public IP address. Instead, you connect to it using an internal endpoint or a public endpoint.

• VPC access: You can access and use a Milvus instance from within its own VPC or from other VPCs.

  Important

  • VPC access is enabled by default for Milvus instances. When you create a Milvus instance, the system automatically creates an endpoint within the selected VPC to ensure internal connectivity. The endpoint name follows the format InstanceName-milvus-vpce. Do not delete this endpoint, or you will lose access to your instance.

  • VPC access is controlled by a security group whitelist. You can find the corresponding security group and configure its rules on the Details page of the Milvus instance or the details page of the endpoint.

• Public access: You can access and use a Milvus instance over the public internet. Enabling public access does not affect existing VPC access.

  Important

  Public access is disabled by default for Milvus instances. When you enable it, you must configure the Public Access Whitelist on the Security Configuration page to restrict access to the instance by IP address.

Enable public access

New Milvus instances are accessible only through an internal endpoint by default. If you need to connect from the internet, follow these steps to enable public access for Proxy and Attu. Both components use the same internal and public endpoints and follow the same security group rules. Proxy uses port 19530, and Attu uses port 3000.

1. On the Security Configuration page of the target instance, click Enable Public Access.

   

2. Enter the public IP address of your client or an IP address range in CIDR notation.

   You can find your client's public IP address by visiting an IP Address discovery service. Separate multiple entries with a comma. Duplicate entries are not allowed. Ensure that CIDR blocks are in the correct format, such as x.x.x.0/24.

   Important

   To ensure a consistent source IP address, connect directly without using a proxy or VPN service.

   

3. Click OK.

Endpoint types

Endpoints include internal and public endpoints. You can find both on the Security Configuration page of your Milvus instance.

• Internal endpoint (accessible within the VPC and across its vSwitches)

  • Proxy internal endpoint format: {{clusterId}}-internal.milvus.aliyuncs.com:19530

  • Attu internal endpoint format: {{clusterId}}-internal.milvus.aliyuncs.com:3000

• Public endpoint

  • Proxy public endpoint format: {{clusterId}}.milvus.aliyuncs.com:19530

  • Attu public endpoint format: {{clusterId}}.milvus.aliyuncs.com:3000

Connect for data migration

When using a third-party tool like Milvus Migration to transfer data to your Milvus instance, connect using an endpoint. The correct endpoint depends on where the migration tool is deployed:

• If the migration tool is deployed on an ECS instance within the same VPC as your Milvus instance, use the internal endpoint: {{clusterId}}-internal.milvus.aliyuncs.com:19530. This method provides low latency and requires no public access configuration.

• If the migration tool is deployed in any other network environment, you must first enable public access and configure the whitelist for your Milvus instance. Then, use the public endpoint to connect: {{clusterId}}.milvus.aliyuncs.com:19530.

Configure network security

You can restrict access to your Milvus instance by configuring whitelists to protect your data. Security settings consist of two parts: a security group whitelist for VPC access and a whitelist for public access.

• VPC security group whitelist (for VPC access control)

  1. On the Details page of the target instance, click the link next to Security Group ID.

     

  2. On the Security Group Details page, click Add Rule to add the necessary security group rules.

     For more information, see Add a security group rule.

• Public Access Whitelist (for public access control)

  1. On the Security Configuration page of the target instance, click Edit next to Public Access Whitelist.

     

  2. Enter the public IP address of your client or an IP address range in CIDR notation.

     You can find your client's public IP address by visiting an IP Address discovery service. Separate multiple entries with a comma. Duplicate entries are not allowed. Ensure that CIDR blocks are in the correct format, such as x.x.x.0/24.

     Important

     To ensure a consistent source IP address, connect directly without using a proxy or VPN service.

     

  3. Click OK.