Configure a whitelist for Tair (Redis OSS-compatible)

Scenario 1: Same-VPC access to Tair (Redis OSS-compatible)

1. Get the IP address ranges of the VPC and vSwitch for your SAE application.

   1. Log on to the SAE console.

   2. In the navigation pane on the left, choose Application Management > Applications. In the top navigation bar, select a region, and then click the name of your application.

   3. On the application's Basic Information tab, find the following information:

      • VPC: On the Basic Information tab, in the Application Information section, click the VPC name to open the VPC console. On the VPC's Basic Information tab, copy the IPv4 CIDR Block.

      • vSwitch: On the Basic Information tab, in the Application Information section, click the vSwitch name to go to the VPC console. On the vSwitch Basic Information page, copy the IPv4 CIDR Block.

2. Log on to the console and go to the Instances page. In the top navigation bar, select the region in which the instance is deployed. Then, find the instance and click its ID.

3. In the navigation pane on the left, click Whitelist Settings.

4. In the default security group, click Modify.

   Note

   You can also click Add Whitelist to create a new group. A group name must be 2 to 32 characters long, consist of lowercase letters, digits, or underscores (_), and must start with a lowercase letter and end with a lowercase letter or digit.

5. In the Modify Whitelist dialog box, for Add Method, select Manual Entry. Paste the VPC and vSwitch IPv4 CIDR blocks from Step 1 into the whitelist. Note that the Group Name is fixed to default. Click OK.

   Note

   A whitelist can contain up to 1,000 IP addresses or CIDR blocks. When adding multiple entries, separate them with a comma (,) without any spaces.

   Once configured, your SAE application can access the Tair (Redis OSS-compatible) instance within the same VPC.

Scenario 2: Cross-VPC/region access to Tair (Redis OSS-compatible)

VPCs and regions are logically isolated from each other. Therefore, you cannot access Tair (Redis OSS-compatible) across VPCs or regions by default. If your application needs to access Tair (Redis OSS-compatible) across VPCs or regions, select one of the following solutions based on your specific requirements:

• Use a VPC Peering Connection with private IP addresses: Use a VPC Peering Connection. This service connects two VPCs, allowing them to communicate using private IP addresses as if they were in the same network. Once you establish the connection, follow the steps in Scenario 1: Same-VPC access to Tair (Redis OSS-compatible) to add the application's private IP address to the database whitelist.

• Use an Internet NAT Gateway with a public IP address: Create an Internet NAT Gateway in the application's VPC. Then, add the gateway's public IP address to the database whitelist. This configuration allows the application to access the database over the internet.

This topic provides an example of the Use an Internet NAT Gateway and a public IP address to access the database method:

1. Prerequisites

   Purchase a NAT gateway and an elastic IP address (EIP) bundle to allow SAE applications to access the internet. For specific steps, see Configure a NAT gateway to enable SAE applications to access the internet.

2. Get the elastic IP address (EIP) associated with your application's NAT gateway and the IPv4 CIDR block of the vSwitch.

   1. Log on to the SAE console.

   2. In the navigation pane on the left, choose Application Management > Applications. In the top navigation bar, select a region, and then click the name of your application.

   3. On the Basic Information tab, in the Application Information section, click the vSwitch name to go to the VPC console. On the vSwitch Basic Information page, copy the IPv4 CIDR Block.

   4. In the navigation pane on the left, choose NAT Gateway > Internet NAT Gateway.

   5. On the Internet NAT Gateway page, copy the Elastic IP Address (EIP) of your NAT gateway.

3. Log on to the console and go to the Instances page. In the top navigation bar, select the region in which the instance is deployed. Then, find the instance and click its ID.

4. In the navigation pane on the left, click Whitelist Settings.

5. In the default security group, click Modify.

   Note

   You can also click Add Whitelist to create a new group. A group name must be 2 to 32 characters long, consist of lowercase letters, digits, or underscores (_), and must start with a lowercase letter and end with a lowercase letter or digit.

6. In the Modify Whitelist dialog box, for Add Method, select Manual Entry. Paste the EIP and the vSwitch IPv4 CIDR block from Step 2 into the whitelist. Click OK. The changes take effect in about one minute.

   Note

   A whitelist can contain up to 1,000 IP addresses or CIDR blocks. When adding multiple entries, separate them with a comma (,) without any spaces.

   Once configured, your SAE application can access the Tair (Redis OSS-compatible) instance across VPCs and regions.

More information

In addition to configuring an IP address whitelist, you can use a security group to control access to your Tair (Redis OSS-compatible) instance. For more information, see Set a whitelist for a Tair (Redis OSS-compatible) instance by using an ECS security group.

FAQ

What do I do if an SAE application cannot access an ApsaraDB RDS instance or a Tair (Redis OSS-compatible) instance?