Access control
ApsaraDB RDS secures your data through two independent control layers: account-based access control (who can query or modify data after connecting) and network-based access control (which hosts are allowed to connect at all). Configure both layers to protect your instance.
Account-based access control
ApsaraDB RDS for PostgreSQL provides the following two ways to create database accounts:
- Create a standard account through the ApsaraDB RDS console or API.
- If you require fine-grained permission control (for example, read-only, read/write, DDL, and DML permissions, or permissions at the table, view, or field level), you must connect to the database as a privileged account and manually run SQL statements. For more information, see Manage permissions in an ApsaraDB RDS for PostgreSQL instance.
Whitelist-based access control
The default IP address whitelist contains only 127.0.0.1, which means the instance denies connections from all IP addresses over the Internet or an internal network. Add the IP addresses or CIDR blocks of your application servers to the whitelist before your application can connect.
Configure the whitelist on the Data Security page of the ApsaraDB RDS console, or use the ApsaraDB RDS API. After you update a whitelist, you do not need to restart your RDS instance — this avoids interruptions to your workloads.