Network isolation
ApsaraDB RDS provides two layers of network security: virtual private clouds (VPCs) for network-layer access control, and IP address whitelists for connection-level filtering. If an ApsaraDB RDS instance resides in a VPC, it is accessible only from an ECS instance that resides in the same VPC — it is not reachable from the Internet unless you explicitly apply for a public endpoint.
Use the following methods to control which clients can reach your instance:
VPC — Isolates your instance at the network layer. Suitable for ECS instances in the same VPC, and for on-premises servers connected via a leased line or VPN.
Public endpoint — Exposes your instance to the Internet. This method is not recommended. Always combine with an IP address whitelist.
VPC
A virtual private cloud (VPC) is a private network that isolates your traffic at the network layer using underlying network protocols.
To extend access to on-premises servers in your data center, connect your data center to Alibaba Cloud using a leased line or a VPN. Once connected, your data center servers and Alibaba Cloud Elastic Compute Service (ECS) instances can both reach the same ApsaraDB RDS instance simultaneously.
If your network uses an overlapping IP address range, assign a customized CIDR block to the ApsaraDB RDS instance in the VPC to resolve IP address resource conflicts.
Combine VPC isolation with IP address whitelists for additional security: the VPC controls which networks can reach the instance at the network layer, and the whitelist controls which individual IP addresses are allowed to connect.
For more information about VPCs, see What is a VPC?
Internet access via public endpoint
Exposing an ApsaraDB RDS instance to the Internet increases its attack surface. This method is not recommended.
If you must accept connections from the Internet, apply for a public endpoint. Internet traffic that reaches the instance through a public endpoint includes:
Access requests from ECS elastic IP addresses (EIPs)
Access requests from the Internet egress of your data center
IP address whitelists apply to all connections, including those through the public endpoint. Configure an IP address whitelist before applying for a public endpoint to avoid a window of unrestricted access.
For instructions, see Apply for or release a public endpoint for an ApsaraDB RDS for MySQL instance.