Use the whitelist template feature

When to use a whitelist template

Use whitelist templates when multiple RDS instances share the same access requirements. For example, if your application servers and analytics tools all need access to several database instances, a single template covers all of them.

Manage access directly on each RDS instance when different instances need different IP rules, or when you want to limit the impact of any configuration change.

Prerequisites

Before you begin, ensure that you have:

• Public endpoints enabled on the RDS instances you want to manage

For instructions, see Apply for or release a public endpoint on an ApsaraDB RDS for PostgreSQL instance.

Limitations

Each entry can be a single IP address or a CIDR block.

Usage notes

• Changes to a whitelist template take effect immediately on the template and propagate to all associated RDS instances within about 1 minute.

• Modifying a template affects every RDS instance associated with it. Evaluate the impact before making changes.

• Deleting a template removes the IP addresses from all associated instances. If only a few instances are affected, disassociate the template from each instance first, then delete the template.

Billing

Free of charge.

Configure a whitelist template

1. Log in to the ApsaraDB RDS console. In the left-side navigation pane, click Whitelist Template.

2. Create, modify, or delete a template:

   Create a template

   Click Create Whitelist Template. Enter a template name and the IP addresses, then click OK.

   Template names must be unique within the same account. After creation, the template name cannot be changed.

   The new template takes effect within 1 minute.

   IP address behavior:

   • 0.0.0.0/0 — all IP addresses can connect over the Internet.

     Using 0.0.0.0/0 exposes the instance to all public IP addresses. If you use this for testing, change it to a restricted address range before going to production.

   • 127.0.0.1 alone — no IP addresses can connect to associated instances.

   • 127.0.0.1 combined with other IPs or CIDR blocks — the 127.0.0.1 entry is ignored.

   Modify a template

   Find the template and click Modify in the Actions column.

   In the panel that appears, you can:

   • Associate or disassociate instances: In the All Instances section on the left, search for or select instances. Click to move selected instances to Selected Instances, or click to remove instances you want to disassociate. You can associate up to 20 instances at a time.

   • Update IP addresses: Add or modify IP addresses based on your requirements.

   Click OK. Changes propagate to all associated instances within about 1 minute.

   Delete a template

   Find the template and click Delete in the Actions column, then click OK.

   Deleting the template removes its IP address whitelist from all associated instances. Disassociate the template from instances first if you want to preserve their connectivity.

Manage template associations from an instance

Use this path when you want to attach or remove a whitelist template from a specific instance, rather than managing instance associations from the template itself.

1. Log in to the ApsaraDB RDS console. In the left-side navigation pane, click Instances.

2. Click the ID of the target RDS instance. In the left-side navigation pane, click Whitelist and SecGroup.

3. Associate or disassociate a template:

   • Associate: Click Associate Whitelist Template. Select the template and click OK. After association, the template's IP addresses appear on the Whitelist Settings tab.

   • Disassociate: Find the template and click Unassociate in the Actions column, then click OK.

API reference

All whitelist template operations are also available via API.

What's next

• Configure an IP address whitelist — manage access rules on a single RDS instance directly

• Errors and FAQ about IP address whitelist settings in ApsaraDB RDS for PostgreSQL