Set allowlist groups

This topic describes how to configure instance-level and tenant-level allowlist groups to control client access to tenants in a cluster instance.

Background information

• Instance-level IP allowlist groups

  OceanBase Cloud supports IP allowlist groups for cluster instances. Each instance has a default allowlist group that cannot be deleted. Before connecting to and using an instance for the first time, configure its IP allowlist. You can add up to 10 groups. Group names must be unique, and groups cannot be empty. Each group can contain up to 40 IP addresses or ranges. Allowlist groups protect access to cluster instances. We recommend maintaining them regularly.

• IP allowlist groups for tenants

  OceanBase Cloud supports IP allowlist groups for tenants. Use these groups to specify which IP addresses can access the current tenant. You can add up to 10 groups. Group names must be unique, and groups cannot be empty. Each group can contain up to 40 IP addresses or ranges.

Considerations

• Instance-level IP allowlist groups apply to all tenants in the instance.
• The tenant allowlist page also displays allowlist groups inherited from the instance.
• If you use Huawei Cloud and connect to the database over a private network, neither instance-level nor tenant-level OceanBase Cloud allowlists can control access. To control access, use Huawei Cloud security groups on your endpoint.

Set instance-level allowlist groups

1. Log in to the OceanBase Cloud console.

2. In the left-side navigation pane, click Instances to find your target instance and go to the Overview page.

3. In the left-side navigation pane, click Security.

4. Click Allowlists to open the allowlist tab.

5. Use either of the following methods to add allowlist groups.

   Add allowlist groups manually

   Import allowlist groups

   1. Click Add Allowlist.

   2. In the dialog box, configure the following parameters.

      Parameter	Description
      Group Name	The name must start with a lowercase English letter and end with a lowercase English letter or a digit. It can contain only lowercase English letters, digits, and underscores, and must be 2–32 characters long.
      IP Address	Enter an IP address (such as 192.0.2.1) or an IP range (such as 192.0.2.0/24). Separate multiple IP addresses or ranges with commas, for example, 192.0.2.1,192.0.2.0/24. With 0.0.0.0/0, the allowlist accepts any source IP address. Each group can contain up to 40 IP addresses or ranges.

   3. Click OK.

   1. Click Import allowlist groups.

   2. In the Import allowlist groups dialog box, configure the following parameters to reuse allowlist groups from other instances in the current project.

      Parameter	Description
      Source instance	Select the source instance from the drop-down list.
      Allowlists	After you select a source instance, the list displays its allowlist groups and their IP addresses. Select the groups to import.

   3. Click OK.

      Note

      If a selected group has the same name as an existing group in the current instance, a second confirmation prompt appears. Once you confirm, the system appends _copy to the duplicate name. If the resulting name still exists, the system keeps appending _copy until the name is unique. Existing groups are not overwritten.

6. After adding allowlist groups, you can perform the following operations as needed.

   • Edit: Click the edit icon next to a group, modify its IP addresses or ranges, and click OK.
   • Copy: Click the copy icon next to a group to copy its IP address entries to the clipboard.
   • Delete: Click the delete icon next to a group, and then click Delete in the confirmation dialog box.

Set tenant-level allowlist groups

1. Log in to the OceanBase Cloud console.

2. In the left-side navigation pane, click Instances to find your target instance and go to the Overview page.

3. In the left-side navigation pane, click Tenants to open the tenant list. Click the target tenant to open its Overview page.

4. In the left-side navigation pane, click Security.

5. Configure allowlist groups or associate security groups for the tenant as needed.

   Note

   • Allowlists: Specify the IP addresses or ranges allowed to access the current tenant.
   • Security groups: Associate an Alibaba Cloud Elastic Compute Service (ECS) security group. ECS instances in the associated group can then access the current tenant over the private network.
   Configure allowlists

   Configure security groups

   1. Click the Allowlists tab.

   2. Click Add Allowlist.

   3. In the dialog box, configure the following parameters.

      Parameter	Description
      Group Name	The name must start with a lowercase English letter and end with a lowercase English letter or a digit. It can contain only lowercase English letters, digits, and underscores, and must be 2–32 characters long.
      IP Address	Enter an IP address (such as 192.0.2.1) or an IP range (such as 192.0.2.0/24). Separate multiple IP addresses or ranges with commas, for example, 192.0.2.1,192.0.2.0/24. With 0.0.0.0/0, the allowlist accepts any source IP address. Each group can contain up to 40 IP addresses or ranges.

   4. Click OK.

   Note

   • Allowlist groups inherited from the instance are marked (Inherited from instance). Hover over the label to view the explanation. To modify an inherited group, click Allowlists in the tooltip. This opens the owning instance's Security page in a new browser tab with the Allowlists tab selected.
   • For a group added to the current tenant, click the edit icon next to the group to add or remove IP addresses or ranges, and then click OK. To delete a group, click its delete icon and then click Delete in the confirmation dialog box.

   Note

   • The security group feature is supported only for users who access OceanBase Cloud through Alibaba Cloud Marketplace.
   • Before associating a security group, make sure the tenant has a private network connection and you have permission to perform the operation.
   • Security groups apply only to private network connections. Configuration changes take about 5 minutes to take effect, including associating or disassociating security groups and changing instances in a security group.

   1. Click Security Groups to open the security group tab.

   2. Click Associate Security Groups. If the message Unauthorized Alibaba Cloud account appears, click Authorize to complete authorization in the Alibaba Cloud console.

   3. In the Associate Security Groups dialog box, select the target security groups and move them to the selected list on the right. You can select up to 3 security groups.

   4. Click OK to submit the associations.

   5. To disassociate a security group, click the delete icon next to it on the Security Groups tab, and then click Delete in the confirmation dialog box.

   Note

   This operation removes only the association with the current tenant. It does not delete the security group in Alibaba Cloud.