Network access and security settings

Network access types

Milvus supports VPC access and public access. A Milvus instance does not have a dedicated public IP address. Instead, you connect to it using an internal endpoint or a public endpoint.

• VPC access: You can access and use a Milvus instance from within its own VPC or from other VPCs.

  Important

  • VPC access is enabled by default for Milvus instances. When you create a Milvus instance, the system automatically creates an endpoint within the selected VPC to ensure internal connectivity. The endpoint name follows the format "InstanceName-milvus-vpce". Do not delete this endpoint, or you will lose access to your instance.

  • VPC access is controlled by a security group whitelist. You can find the corresponding security group and configure its rules on the Details page of the Milvus instance or the details page of the endpoint.

• Public access: You can access and use a Milvus instance over the public internet. Enabling public access does not affect existing VPC access.

  Important

  Public access is disabled by default for Milvus instances. When you enable it, you must configure the public access whitelist on the Security Configuration page to restrict access to the instance by IP address.

Enable public access

New Milvus instances are accessible only through an internal endpoint by default. If you need to connect from the internet, follow these steps to enable public access for Proxy and Attu. Both components use the same internal and public endpoints and follow the same security group rules. Proxy uses port 19530, and Attu uses port 3000.

1. On the Security Configuration page of the target instance, click Enable Public Access.

2. Enter the public IP address of your client or an IP address range in CIDR notation.

   You can find your client's public IP address by visiting an IP Address discovery service. Separate multiple entries with a comma. Duplicate entries are not allowed. Ensure that CIDR blocks are in the correct format, such as x.x.x.0/24.

   Important

   To ensure a consistent source IP address, connect directly without using a proxy or VPN service.

3. Click OK.

Endpoint types

There are two types of endpoints: internal and public. You can view both on the Security Configuration page of the Milvus instance.

• Internal endpoint (accessible within the current VPC, across vSwitches)

  • The Proxy internal endpoint follows this format: {{clusterId}}-internal.milvus.aliyuncs.com:19530

  • The Attu internal endpoint follows this format: {{clusterId}}-internal.milvus.aliyuncs.com:3000

• Public endpoint

  • The Proxy public endpoint follows this format: {{clusterId}}.milvus.aliyuncs.com:19530

  • The Attu public endpoint follows this format: {{clusterId}}.milvus.aliyuncs.com:3000

Network connectivity for data migration

When you use a third-party migration tool such as Milvus Migration to migrate data to a Milvus instance, you must connect to the instance through an endpoint. Choose the connection method based on where the migration tool is deployed:

• The migration tool is deployed on an ECS instance in the same VPC as the Milvus instance: Use the internal endpoint {{clusterId}}-internal.milvus.aliyuncs.com:19530 to connect. This method provides low network latency and does not require public access configuration.

• The migration tool is deployed in a different network environment: Enable public access for the Milvus instance and configure the whitelist first, and then use the public endpoint {{clusterId}}.milvus.aliyuncs.com:19530 to connect.

Network security settings

You can configure network security whitelists to restrict access to your Milvus instance and protect your data. Network security settings include the VPC security group whitelist and the public access whitelist.

• VPC security group whitelist (VPC access control)

  1. On the Details page of the target instance, click the link next to Security Group ID.

  2. On the Security Group Details page, click Manually Add to add security group rules.

     For more information, see Security group overview.

• Public access whitelist (public access control)

  1. On the Security Configuration page of the target instance, click Edit next to Public Access Whitelist.

  2. Enter the public IP address of your client or an IP address range in CIDR notation.

     You can find your client's public IP address by visiting an IP Address discovery service. Separate multiple entries with a comma. Duplicate entries are not allowed. Ensure that CIDR blocks are in the correct format, such as x.x.x.0/24.

     Important

     To ensure a consistent source IP address, connect directly without using a proxy or VPN service.

  3. Click OK.