To ensure secure access to a Tair (Redis OSS-compatible) instance, you need to establish network connectivity between your client and the instance and configure IP address whitelists.
Establish network connectivity
When you connect to a Tair (Redis-compatible) instance, network connectivity between the client and the instance is essential for a successful connection. Select an appropriate network type based on the client location.
Client location | Recommended network type | Description |
Elastic Compute Service (ECS) or Container Service for Kubernetes (ACK) |
| |
On-premises client | Internet | You need to configure an IP address whitelist first, and then apply for a public endpoint. |
Server in the self-managed data center | Connect your data center to the Tair instance over an Express Connect circuit to enable network connectivity between on-premises and cloud environments. |
For more information about network connectivity, see Network connection planning.
Configure IP address whitelists
Only IP addresses in the whitelists of an instance can access the instance.
Log on to the console and go to the Instances page. In the top navigation bar, select the region in which the instance that you want to manage resides. Then, find the instance and click the instance ID.
In the left-side navigation pane, click Whitelist Settings.
Add appropriate IP addresses to the whitelist based on the client location.
ECS
In the Actions column corresponding to the default security group, click Modify.
Set Method to Add IP Address to Import ECS Internal IP Address. The panel displays the private IP addresses of ECS instances in the same region as the instance.
Move the pointer over an IP address to view the ID and name of the ECS instance to which the IP address is assigned.
Select the required IP addresses and move them to the right-side section.
Click OK.
ACK
Click the Security Groups tab next to the Whitelist Setting tab.
Click Add Security Group, select the security group corresponding to ACK in the dialog box, and then move it to the right-side section.
ACK security group: Cluster Information > Basic Information > Network > Control Plane Security Group.
Click OK.
On-premises client
To obtain your public IP address, enter the curl ifconfig.me command in the command line of your client.
In the Actions column corresponding to the default security group, click Modify. Add the public IP address you obtained.
Click OK.
NoteIf your client's IP address changes dynamically, see How do I configure whitelists for dynamic IP addresses?
For more information about configuring whitelists, see Configure whitelists.
If you connect the instances over the Internet, after configuring a whitelist, apply for a public endpoint in the Connection Information section of the instance details page.
Next, refer to the following topics to connect to your instance:
FAQ
How do I configure whitelists for dynamic IP addresses?
For ECS instances in an auto scaling group, see Automate the addition or removal of the private IP addresses of ECS instances to or from the IP address whitelists of Tair instances.
For IP addresses within a fixed range, you can configure a whitelist using CIDR notation. For example, 10.23.12.0/24 represents the IP address range from 10.23.12.0 to 10.23.12.255.
For IP addresses outside a fixed range, you can use a script to monitor IP address changes and call the ModifySecurityIps operation to update the whitelist accordingly.