Docs

Cache for Redis

Managing allowlists

Creating an allowlist

After the Cache for Redis instance is created successfully, you can set allowlist for the instance to allow devices to access the instance. This topic describes how to create allowlist via the console.

Background information

To ensure the security and stability of the Redis database, accessing Redis instances from any IP address is not allowed by default in the system. Before using Redis instances, you need to create an allowlist and add the client's IP address or CIDR block to the allowlist of the Redis instance to allow the client to access the Redis instance. We recommend that you regularly maintain and manage the allowlist to ensure the security of accessing Redis instances.

Precautions

For data security reasons, it is not allowed to add the address 0.0.0.0/0 to the allowlist of the instance while enabling the password-free access function. If you need to set address 0.0.0.0/0 in the allowlist, disable the instance's password-free access feature first. To enable password-free access, refer to Password-free access.

Procedure

In the upper-left corner of the top menu bar, select the project and region to which the instance belongs.

In the left navigation bar, choose NoSQL Database> Redis > Allowlists.

On the Allowlists page, click Create allowlist.

In the Create allowlist panel, set the following parameters.

Parameters	Description
Project	Select the project to be added to the allowlist from the drop-down list. By default, the default project will be added. tip If you use the Redis cloud service through IAM user, you can only see the allowlist information under the projects that have been authorized for the current IAM user. For more details, refer to Using Redis with IAM user.
Allowlist name	Enter the name of the allowlist, which must meet all the following requirements: It cannot start with a number or hyphen (-). It can only contain Chinese characters, letters, digits, underscores (_), and hyphens (-). The length should be 1 to 128 characters.
Description	Enter remarks on the allowlist, which must not exceed 200 characters.
IP address	Enter IP addresses or IP address segments in CIDR format. tip If you enter or paste an incorrect IP address or address segment, you can double-click the IP address or address segment that needs to be modified, and then modify it to the correct IP address or address segment in the Edit IP pop-up window. Duplicate addresses are not allowed. Separate multiple addresses with commas (,). Setting 0.0.0.0/0 indicates that all addresses are allowed to access. Setting 127.0.0.1 indicates that all addresses are denied access. If set both 0.0.0.0/0 and 127.0.0.1, all addresses are allowed to access. Setting CIDR 192.168.1.0/24 indicates that IP addresses within this network segment are allowed to access. If set 192.168.1.1, only this IP address is allowed to access.
Default allowlist	Select whether to set the new creation allowlist to the default allowlist. If set as the default allowlist, it is automatically selected when creating new instances. tip Each Volcano Engine account can allow up to one default allowlist per region. A newly created default allowlist will automatically override the existing default allowlist. That is, the existing default allowlist will automatically become a non-default allowlist. For more details, refer to Constraints and limits.
Security groups	Cache for Redis does not associate any ECS security groups with a new allowlist by default. You can refer to the following steps to associate an ECS security group with the current allowlist: Click Select security group. In the pop-up dialog box, select a security group to associate according to business needs from any security group association mode. Redis allowlists support the following two association modes: Associated ECS IP: Allows cloud servers within the security group to access the database. Currently, only the IP information of the primary network card is supported for import. Inbound IP: Allows IP addresses involved in the TCP protocol and ALL protocol in the source addresses of the inbound direction of the security group to access the database. If the source address is configured as a security group, it will be ignored. tip When associating with a security group, you can select any one of the association modes or both of the above association modes simultaneously, but it is required to ensure that there is at least one IP or IP address segment in the associated ECS security group. Each allowlist can be associated with at most 10 ECS security groups. An allowlist supports at most 300 IPs or IP segments. If the number of IPs or IP segments involved in associating with a security group exceeds the limit, the association will fail. You can adjust the IPs in the security group and then re-associate. Click OK. tip To remove selected ECS Security groups from the current allowlist, click Disassociate in the Actions column on the right side of the Security group list. After associating ECS Security groups, if the associated ECS Security groups are updated, you need to manually sync the ECS Security groups in the Redis allowlist to retrieve the latest IP list from the ECS Security groups. For specific procedures, refer to Synchronizing security group.

Click OK.

Subsequent operations

After creating the allowlist, you can associate the group to the target instance. For more information on how to associate allowlists, refer to Associating instances and allowlists.

Relevant APIs

API	Description
CreateAllowList	Call the CreateAllowList API to create a new IP address allowlist.
DescribeAllowLists	Call the DescribeAllowLists API to query all IP address allowlists in specified region under current account.

Last updated: 2026.07.31 11:59:31