Add an Alibaba Cloud instance to the allowlist

If you select the public network connection method when creating a data source or a data migration task for Alibaba Cloud, you must first add the displayed data source IP address to the allowlist of the MySQL database instance (including RDS MySQL, PolarDB MySQL, and self-managed MySQL), self-managed Oracle database instance, self-managed OceanBase database instance, Kafka instance (including cloud Kafka and self-managed Kafka), PostgreSQL database instance (including RDS PostgreSQL and self-managed PostgreSQL), self-managed TiDB database instance, Alibaba Cloud HBase database instance, and Alibaba Cloud Lindorm database instance. This ensures the data source can access them.

Obtain the IP address to add to the allowlist

1. Log in to the OceanBase Cloud console.

2. Go to the Create Data Source dialog box.

   This topic uses the operations on the Create Data Source page as an example. You can also click Data Services > Data Migration > Data Migration to obtain the IP address to add to the allowlist on the Create Migration Task page.

   1. In the left-side navigation pane, click Data Services > Data Source.

   2. On the Data Source page, click Create Data Source in the upper-right corner and select the type of data source you want to create.

3. In the Create Data Source dialog box, set Cloud Vendor to Alibaba Cloud, Connection Type to Public IP, and select the appropriate instance type based on your needs.

4. Copy the IP address displayed below the Connection Information text box.

   Note

   The region selected here must match the region where the Alibaba Cloud instance is located.

Add an IP address to the allowlist for an RDS MySQL or PostgreSQL instance

1. Log in to the Instances page of the RDS console.

2. Select the region where the target instance is located at the top of the page.

3. Click the name of the target instance to go to its Basic Information page.

4. In the left-side navigation pane, click Allowlist and Security Group.

5. On the Allowlist Settings tab, click Add Allowlist.

   If you want to add the IP address to an existing allowlist group, click Modify next to the target group.

6. In the Add Allowlist dialog box, enter a Group Name and Allowlist within Group.

   If modifying an allowlist group, you only need to enter the Allowlist within Group. This is the IP address you copied from the Create Data Source or Create Migration Task page.

7. After adding or modifying the allowlist group, click OK.

Add an IP address to the allowlist for a PolarDB MySQL instance

1. Log in to the Clusters page of the PolarDB console.

2. Select the region where the target cluster is located at the top of the page.

3. Click the name of the target cluster to go to its Basic Information page.

4. In the left-side navigation pane, click Configuration and Management > Cluster Allowlist.

5. In the IP List section, click Add IP Allowlist Group.

   If you need to add an IP address to an existing allowlist group, click Configuration next to the target group.

6. In the Add IP Allowlist Group dialog box, enter the IP Allowlist Group Name and the IP Address within the Allowlist.

   If modifying an allowlist group, you only need to enter the IP Address within the Allowlist in the Configure Allowlist dialog box. This allowlist address is the IP address you copied from the Create Data Source or Migration Task page.

7. After adding or modifying the allowlist group, click OK.

Add an allowlist for a Kafka instance

1. Log in to the Instances page of the Kafka console.

2. Select the region where the target instance is located at the top of the page.

3. Click the name of the target instance to go to the Instance Details page.

4. In the left navigation pane, click Allowlist Management.

5. On the Allowlists tab, click Add Allowlist.

   If you need to add an IP address to an existing allowlist group, click Modify next to the target group.

6. In the Add Allowlist dialog box, enter the Group Name and the Allowlist within the Group.

   If modifying an allowlist group, you only need to enter the Allowlist within the Group. This allowlist address is the IP address you copied from the Create Data Source or Migration Task page.

7. After adding the allowlist group, click OK.

   If modifying an allowlist group, click Modify.

Add an allowlist for a self-managed MySQL/Oracle/OceanBase/Kafka/PostgreSQL/TiDB/RocketMQ instance

1. Log in to the Security Groups page of the Alibaba Cloud Elastic Compute Service (ECS) console.

2. Select the region where the target security group is located at the top of the page.

3. Click the name of the target security group to go to the Security Group Details page.

4. In the Access Rules > Inbound section, click Quick Add.

   You can also choose Manual Add to manually enter information such as the Port Range and Authorized Object.

5. In the Quick Add dialog box, enter the IP address you copied from the Create Data Source or Migration Task page into Authorized Object, and select the Port Range.

6. After configuration, click OK.

Add an Alibaba Cloud HBase instance to the allowlist

1. Log in to the HBase Console.

2. Select the region where the target instance is located at the top of the page.

3. In the instance list, find the target instance and click its ID.

4. In the left-side navigation pane, click Access Control.

5. On the Allowlist Settings tab, click Modify Group Allowlist.

6. In the Modify Group Allowlist dialog box, enter the IP address or IP range to be accessed, then click OK.

   Note

   • The default allowlist contains only the default IP address 127.0.0.1, which means no device can access this instance.
   • 0.0.0.0/0 and empty mean no IP access restrictions are set. This poses a high security risk to the database. Entering the IP address 0.0.0.0 or the IP range 0.0.0.0/0 is prohibited.
   • If accessing the cluster from the public network, enter the public IP. If accessing the cluster from a local device, you can search for the public IP in a search engine.

Add an Alibaba Cloud Lindorm instance to the allowlist

1. Log in to the Lindorm Console.

2. Select the region where the target instance is located at the top of the page.

3. On the instance list page, click the target instance ID or the management icon in the Actions column of the target instance's row.

4. In the left-side navigation pane, click Access Control.

5. Click Create Group Allowlist.

6. In the Create Group Allowlist dialog box, set the Group Name and Allowlist within the group.

   Note

   • The group name supports only English letters, numbers, and underscores.
   • The following IP address or IP range formats are supported.
     • A single IP address, for example: 192.0.XX.XX.
     • IP ranges support CIDR notation, which stands for Classless Inter-Domain Routing. For example: 192.0.XX.XX/24, where /24 indicates the prefix length of the address, with a range of [1, 32].
   • Multiple IP addresses or IP ranges must be separated by commas (,).
   • Setting the IP address to 127.0.0.1 prohibits access to the Lindorm instance from all IP addresses.

7. Click OK.

Add an Alibaba Cloud RocketMQ instance to the allowlist

1. Log in to the RocketMQ Console and click Instances in the left-side navigation pane.

2. Select a region from the top menu bar, such as East China 1 (Hangzhou), then click the target instance name in the instance list.

3. Click Access Control in the left-side navigation pane.

4. On the Access Control page, click the IP Allowlist tab, then click Add IP to Allowlist.

5. In the Add IP to Allowlist panel, configure the IP address or IP range.

6. Click OK to complete the configuration.

Add access control for Alibaba Cloud DataHub instances

1. Log in to the RAM Access Control Console.

2. Add a custom permission policy for the IP allowlist.

   1. Return to the RAM Access Control Console.

   2. In the left navigation pane, choose Permission Management > Permission Policy.

   3. Click Create Permission Policy.

   4. On the configuration page, click the Script Editing tab.

   5. Clear the existing code in the input box, copy and paste the following JSON code, and configure the required IP address.

      {
          "Version": "1",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": "datahub:*",
                  "Resource": "*",
                  "Condition": {
                      "IpAddress": {
                          "acs:SourceIp": [
                              "xx.xx.xx.xx",
                              "xx.xx.xx.xx/24"
                          ]
                      }
                  }
              }
          ]
      }
      

      • "Action": "datahub:*": Grants all operation permissions (read/write, management) for DataHub.
      • "Resource": "*": Allows access to all DataHub Projects and Topics under this account.
      • "acs:SourceIp": [...]": Adds an IP allowlist for access. If IP allowlist restrictions are not needed, delete the entire Condition field.

3. Grant DataHub permissions to the RAM user.

   1. In the left navigation pane, click Identity Management > User.

   2. Find the RAM user to be authorized and click their name.

   3. On the user details page, click the Permission Management tab, then click the Add Permission button.

   4. In the pop-up panel, select System Policy.

   5. Enter "DataHub" in the search box, select the IP permission policy created in the previous step, and click OK.

4. Obtain or create an AccessKey for the RAM user. If the current user already has an AccessKey, use it directly.

   1. Return to the user details page and click the Authentication Management tab.

   2. Obtain the AccessKey ID and AccessKey Secret in the AccessKey section.

      • If you already have an AccessKey, use it directly.

      • If you do not have an AccessKey, click Create AccessKey. After completing the security verification, the AccessKey ID and AccessKey Secret will be displayed.

        Note

        Be sure to save the AccessKey Secret immediately. The Secret is displayed only once during creation and cannot be retrieved after closing the window.