Skip to content
31 changes: 25 additions & 6 deletions tidb-cloud/configure-ip-access-list.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,9 @@ For each TiDB Cloud Dedicated cluster in TiDB Cloud, you can configure an IP acc
>
> This document applies to [**TiDB Cloud Dedicated**](/tidb-cloud/select-cluster-tier.md#tidb-cloud-dedicated). For instructions on configuring an IP access list for **{{{ .starter }}}** or **{{{ .essential }}}**, see [Configure {{{ .starter }}} or Essential Firewall Rules for Public Endpoints](/tidb-cloud/configure-serverless-firewall-rules-for-public-endpoints.md).

To configure an IP access list for your TiDB Cloud Dedicated cluster, take the following steps:
## Add an IP address

To add an IP address to the IP access list for your TiDB Cloud Dedicated cluster, take the following steps:

1. Navigate to the [**My TiDB**](https://tidbcloud.com/tidbs) page, and then click the name of your target TiDB Cloud Dedicated cluster to go to its overview page.

Expand All @@ -21,10 +23,27 @@ To configure an IP access list for your TiDB Cloud Dedicated cluster, take the f

2. In the left navigation pane, click **Settings** > **Networking**.
3. On the **Networking** page, click **Add IP Address**.
4. In the displayed dialog, choose one of the following options:
4. In the **Add IP Address** dialog, add IP addresses with an optional description. For each TiDB Cloud Dedicated cluster, you can add up to 100 IP addresses.

- To add a custom IP address, click the **+** icon, enter the IP address in CIDR notation (for example, `192.168.1.1/32`), and add a description.
- To add the current IP address of your computer, click **Add Current IP**.
Comment thread
qiancai marked this conversation as resolved.
- To allow any IP address to access your cluster, click **Allow access from anywhere**. This adds the `0.0.0.0/0` CIDR entry. This is highly risky and NOT recommended for production environments.
Comment thread
qiancai marked this conversation as resolved.

5. Click **Save**.

## Edit an IP address

To edit an existing IP address in the IP access list, take the following steps:

1. On the **Networking** page, locate the IP address you want to edit in the **IP Access List**.
2. Click **...** in the row of the IP address, and then click **Edit**.
3. In the **Edit IP Address** dialog, modify the IP address or description as needed.
4. Click **Submit**.

## Delete an IP address

- **Allow access from anywhere**: allows all IP addresses to access TiDB Cloud. This option exposes your TiDB Cloud Dedicated cluster to the internet completely and is highly risky.
- **Use IP addresses** (recommended): you can add a list of IPs and CIDR addresses that are allowed to access TiDB Cloud via a SQL client.
To delete an existing IP address from the IP access list, take the following steps:

5. If you choose **Use IP addresses**, add IP addresses or CIDR range with an optional description. For each TiDB Cloud Dedicated cluster, you can add up to 100 IP addresses.
6. Click **Confirm** to save your changes.
1. On the **Networking** page, locate the IP address you want to delete in the **IP Access List**.
2. Click **...** in the row of the IP address, and then click **Delete**.
3. In the confirmation dialog, click **Delete**.
4 changes: 2 additions & 2 deletions tidb-cloud/migrate-from-mysql-using-data-migration.md
Original file line number Diff line number Diff line change
Expand Up @@ -536,7 +536,7 @@ To create a private endpoint from the **Networking** page, take the following st

1. Log in to the [TiDB Cloud console](https://tidbcloud.com/) and navigate to the overview page of your {{{ .premium }}} instance.
2. In the left navigation pane, click **Settings** > **Networking**.
3. In the **AWS Private Endpoint for External Services** section, click **Create Private Endpoint for External Services**.
3. In the **AWS Private Endpoints for External Services** section, click **Create Private Endpoint for External Services**.
4. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint and the **Endpoint Service Name** you copied when setting up AWS PrivateLink for the MySQL source database.

> **Note:**
Expand Down Expand Up @@ -729,7 +729,7 @@ On the **Create Migration Job** page, configure the source and target connection
- Based on the selected **Connectivity method**, do the following:

- If **Public** is selected, fill in the **Hostname or IP address** field with the hostname or IP address of the data source.
- If **Private Link** is selected, in the **Private Endpoint** field, select an existing private endpoint, or click **Create a Private Endpoint here** to create one. Private endpoints are managed under **Networking** > **Private Endpoint for External Services** for your {{{ .premium }}} instance. You can reuse a private endpoint across multiple Data Migration jobs and changefeeds. For setup details, see [Private link or private endpoint](#private-link-or-private-endpoint).
- If **Private Link** is selected, in the **Private Endpoint** field, select an existing private endpoint, or click **Create a Private Endpoint here** to create one. Private endpoints are managed under **Networking** > **AWS Private Endpoints for External Services** for your {{{ .premium }}} instance. You can reuse a private endpoint across multiple Data Migration jobs and changefeeds. For setup details, see [Private link or private endpoint](#private-link-or-private-endpoint).

</CustomContent>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ On the **Create Migration Job** page, configure the source and target connection
<CustomContent plan="premium">

- **Hostname or IP address** (for Public): the hostname or IP address of the data source.
- **Private Endpoint** (for Private Link): the private endpoint that you created in **Networking** > **Private Endpoint for External Services** for your {{{ .premium }}} instance. Alternatively, click **Create a Private Endpoint here** to create one. For setup details, see the [Private link or private endpoint](/tidb-cloud/migrate-from-mysql-using-data-migration.md#private-link-or-private-endpoint) section in the Data Migration guide.
- **Private Endpoint** (for Private Link): the private endpoint that you created in **Networking** > **AWS Private Endpoints for External Services** for your {{{ .premium }}} instance. Alternatively, click **Create a Private Endpoint here** to create one. For setup details, see the [Private link or private endpoint](/tidb-cloud/migrate-from-mysql-using-data-migration.md#private-link-or-private-endpoint) section in the Data Migration guide.

</CustomContent>

Expand Down
16 changes: 8 additions & 8 deletions tidb-cloud/premium/set-up-sink-private-endpoint-premium.md
Original file line number Diff line number Diff line change
Expand Up @@ -82,12 +82,12 @@ On AWS, choose a connection type based on the downstream service:

**AWS Endpoint Service**

1. On the **Networking** page, click **Create Private Endpoint** in the **AWS Private Endpoint for External Services** section.
2. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint.
1. On the **Networking** page, click **Create Private Endpoint for External Services** in the **AWS Private Endpoints for External Services** section.
2. In the displayed dialog, enter a name for the private endpoint.
3. Follow the reminder to authorize the [AWS Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-accounts) of TiDB Cloud to create an endpoint.
4. Enter the **Endpoint Service Name** that you collected in the [Network](#network) section, and then select **AWS Endpoint Service** as the connection type.
5. Select the **Number of AZs**. Ensure that the number of AZs and the AZ IDs match your Kafka deployment.
6. If this private endpoint is created for Apache Kafka, enable the **Advertised Listener for Kafka** option.
6. If this private endpoint is created for Apache Kafka, select the **Configure Advertised Listener for Kafka** checkbox.
7. Configure the advertised listener for Kafka using either the **TiDB Managed** domain or the **Custom** domain.

- To use the **TiDB Managed** domain for advertised listeners, enter a unique string in the **Domain Pattern** field, and then click **Generate**. TiDB Cloud will generate broker addresses with subdomains for each availability zone.
Expand All @@ -97,8 +97,8 @@ On AWS, choose a connection type based on the downstream service:

**Amazon MSK Provisioned**

1. On the **Networking** page, click **Create Private Endpoint** in the **AWS Private Endpoint for External Services** section.
2. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint, and then select **AWS MSK Provisioned** as the connection type.
1. On the **Networking** page, click **Create Private Endpoint for External Services** in the **AWS Private Endpoints for External Services** section.
2. In the displayed dialog, enter a name for the private endpoint, and then select **AWS MSK Provisioned** as the connection type.
3. Enter the **MSK Cluster ARN** of your Amazon MSK Provisioned cluster. To learn about how to create an Amazon MSK Provisioned cluster for changefeeds, see [Set Up an Amazon MSK Provisioned Cluster via AWS PrivateLink](/tidb-cloud/setup-aws-msk-provisioned-private-link-service.md).
4. Click **Create** to validate the configurations and create the private endpoint.

Expand All @@ -108,12 +108,12 @@ On AWS, choose a connection type based on the downstream service:

<div label="Alibaba Cloud">

1. On the **Networking** page, click **Create Private Endpoint** in the **Alibaba Cloud Private Endpoint for Changefeed** section.
2. In the **Create Private Endpoint for Changefeed** dialog, enter a name for the private endpoint.
1. On the **Networking** page, click **Create Private Endpoint for External Services** in the **Alibaba Cloud Private Endpoints for External Services** section.
2. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint.
3. Follow the reminder to add TiDB Cloud's Alibaba Cloud account ID to the allowlist of your endpoint service to grant TiDB Cloud VPC access. For more information, see [managing account IDs in the allowlist of an endpoint service](https://www.alibabacloud.com/help/en/privatelink/user-guide/add-and-manage-service-whitelists).
4. Enter the **Endpoint Service Name** that you collected in the [Network](#network) section.
5. Select the **Number of AZs**. Ensure that the number of AZs and the AZ IDs match your Kafka deployment.
6. If this private endpoint is created for Apache Kafka, enable the **Advertised Listener for Kafka** option.
6. If this private endpoint is created for Apache Kafka, select the **Configure Advertised Listener for Kafka** checkbox.
7. Configure the advertised listener for Kafka using either the **TiDB Managed** domain or the **Custom** domain.

- To use the **TiDB Managed** domain for advertised listeners, enter a unique string in the **Domain Pattern** field, and then click **Generate**. TiDB will generate broker addresses with subdomains for each availability zone.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ This document describes how to connect a {{{ .essential }}} instance to an [Alib
To view the Alibaba Cloud account ID and availability zones, do the following:

1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **Alibaba Cloud Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the displayed dialog, you can find the Alibaba Cloud account ID and availability zones.

## Step 1. Set up an ApsaraDB RDS for MySQL instance
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ This document describes how to connect a {{{ .essential }}} instance to an [Amaz
To view the AWS account ID and availability zones:

1. In the [TiDB Cloud console](https://tidbcloud.com), go to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the dialog, note the AWS account ID and availability zones.

## Prerequisites for the Amazon MSK Provisioned cluster
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ This document describes how to connect a {{{ .essential }}} instance to a [Confl
To view the AWS account ID and availability zones, do the following:

1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the displayed dialog, you can find the AWS account ID and availability zones.

## Step 1. Set up a Confluent Cloud network
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ This document describes how to connect a {{{ .essential }}} instance to an [Amaz
To view the AWS account ID and availability zones, do the following:

1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the displayed dialog, you can find the AWS account ID and availability zones.

## Step 1. Set up the Amazon RDS instance
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ For example, the port mapping is as follows:
To view the Alibaba Cloud account ID and availability zones, do the following:

1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **Alibaba Cloud Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the displayed dialog, you can find the Alibaba Cloud account ID and availability zones.

The following table shows an example of the deployment information.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ The mechanism works as follows:
To view the AWS account ID and availability zones, do the following:

1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the displayed dialog, you can find the AWS account ID and availability zones.

The following table shows an example of the deployment information.
Expand Down
Loading