Configure whitelists for a cluster

Precautions

• PolarDB does not support automatically obtaining the private IP addresses of ECS instances in VPCs. You must manually enter the private IP address of the ECS instance that needs to access the PolarDB for MySQL cluster in the whitelist.

• You can configure both IP whitelists and security groups. The ECS instances in the IP whitelist and the ECS instances in the security group can both access the PolarDB for MySQL cluster.

• ali_dms_group (IP whitelist for DMS), hdm_security_ips (IP whitelist for DAS), dtspolardb (IP whitelist for DTS) are automatically generated when you use the related services. Do not modify or delete these groups to avoid affecting the use of the related services.

  Important

  Do not add your business IP addresses to these groups. Otherwise, your business IP addresses may be overwritten when the related services are updated, affecting normal business operations.

  

• You can create up to 50 IP whitelist groups, and all IP whitelist groups support a cumulative total of 1,000 IP addresses or CIDR blocks.

Scenarios

IP whitelists control which IP addresses or security groups can access a PolarDB for MySQL cluster. Configuring IP whitelists provides a high level of access security for your PolarDB for MySQL cluster. We recommend that you maintain whitelists on a regular basis. The following are common scenarios where you need to configure IP whitelists:

• If your ECS instance needs to access a PolarDB for MySQL cluster, you can view the IP address of the ECS instance on the Instance Details page and add it to the IP whitelist.

  Note

  • If your ECS instance and the PolarDB for MySQL cluster are in the same VPC, you can enter the private IP address of the ECS instance or the CIDR block of the VPC.

  • If your ECS instance and the PolarDB for MySQL cluster are not in the same VPC, you can enter the public IP address of the ECS instance or add the security group to which the ECS instance belongs. You can also migrate the ECS instance to the VPC where the PolarDB for MySQL cluster resides, and then enter the private IP address of the ECS instance or the CIDR block of the VPC.

• If your on-premises servers, computers, or other cloud servers need to access a PolarDB cluster, add their public IP addresses to the IP whitelist.

Configure IP whitelists

1. Log in to the PolarDB console，In the navigation pane on the left, click Clusters. Select the Region where the cluster is deployed, and then click the cluster ID to go to the cluster details page。

2. In the left-side navigation pane, choose Settings and Management > Cluster Whitelists.

3. On the Cluster Whitelists page, you can Add IP Whitelist or Modify an existing whitelist group.

   • Add an IP whitelist group:

     Click Add IP Whitelist. In the Add IP Whitelist dialog box, enter the group name and the IP addresses that are allowed to access the cluster.

   • Configure an IP whitelist group:

     Click Modify to the right of the target IP whitelist group name. In the Modify Whitelist dialog box, enter the IP addresses that are allowed to access the cluster.

   Note

   • The name of the IP whitelist group must meet the following requirements:

     • It can contain lowercase letters, digits, and underscores (_).

     • It must start with a letter and end with a letter or digit.

     • It must be 2 to 120 characters in length.

   • For IP addresses in the whitelist:

     • You can enter an IP address (such as 192.168.0.1) or a CIDR block (such as 192.168.0.0/24).

     • When pods in a Kubernetes cluster (such as ACK) access the cluster, the pod IP addresses change when containers are recreated. Configure the CIDR block to which the pod IP addresses belong instead of a single pod IP address. For example, if the pod IP addresses are in the 172.19.34.x range, configure 172.19.34.0/24. If you are not sure about the CIDR block, you can configure 172.19.0.0/16. You can also associate a security group. The ECS instances in the security group are automatically added to the whitelist.

     • Separate multiple IP addresses with commas (,), for example, 192.168.0.1,192.168.0.0/24.

     • 127.0.0.1 indicates that no IP address is allowed to access the cluster.

     • 0.0.0.0/0 indicates that any IP address is allowed to access the database cluster. This setting significantly reduces the security of the database. Do not use this setting unless necessary.

   • Each cluster includes a default IP whitelist group named default that contains the IP address 127.0.0.1, which means no IP address can access the cluster.

FAQ

For more information about IP whitelist issues, see Troubleshoot IP whitelist issues.

References

• Set up a global IP whitelist template: A global IP whitelist template allows you to maintain a single set of IP whitelist templates that dynamically apply to all associated PolarDB clusters.

• Configure a security group: After a security group is added, the ECS instances in the security group are automatically added to the PolarDB cluster whitelist and kept up to date. This eliminates the need to manually update the PolarDB cluster whitelist after new ECS instances are added.

Related API operations