Control network access to a database

Applications connect to a TIR DBaaS database over its public endpoint, from the addresses in its IP allowlist. They can also connect privately from inside a VPC the database is attached to. You set both in Network & Security when you create the database, and change them later from Edit.

Before you begin

• The public IPv4 addresses or CIDR ranges your applications and your own computer connect from.
• (Optional) An Active VPC in the project with at least one free IP address, for private connections. To make one, see Create a VPC.
• The DBaaS create permission to set access on a new database, or the update permission to change it on an existing one. See TIR Access Control.
• A database in the Running state, if you are changing an existing one.

How the IP allowlist works

Only the addresses in the IP allowlist can reach the database’s public endpoint. A database needs at least one range to be created or updated. The public endpoint opens once the database is Running, and Public Endpoint on the Overview tab then has the address and port your applications connect to.

The allowlist holds up to 50 ranges, IPv4 only. Each range can have a description of up to 63 characters. The allowlist covers the public endpoint only; connections from inside an attached VPC bypass it.

Add IP ranges

In Network & Security, under IP Allowlist:

1. To allow the computer you are using now, select Add my IP. It adds your public IPv4 address as a /32 range. If TIR cannot detect your address, type it in yourself.
2. To allow another address or range, type an IPv4 address or CIDR range, such as 203.0.113.0/24. (Optional) Enter a description that says what the range is for. Then select Add, or press Enter.
3. Repeat for each range. To take a range out, select the remove button on its row.

A single address is stored as a /32 range. A range typed with host bits set, such as 203.0.113.5/24, is stored as its network, 203.0.113.0/24. Each range can be in the list only once.

Add each range before you save; a range left typed in the box stops the save until you add it or clear the box.

Allow any address

Allow from anywhere adds 0.0.0.0/0, which lets any IPv4 address reach the public endpoint. Use 0.0.0.0/0 only for short-lived testing, and replace it with the ranges you need as soon as you know them. While it is in the list, the database is Open to any IPv4 address.

Attach the database to a VPC

Attach a VPC when your applications run on VMs or services inside that VPC. They then connect to the database’s private address and their traffic stays off the internet.

1. In Network & Security, under VPC, choose an Active VPC that has at least one free address.
2. To make a new VPC from here, select Click here. When the VPC is Active, refresh the VPC list and choose it.

On a new database, TIR attaches the VPC once the database turns Running. Private Endpoint on the Overview tab then shows its address on the VPC. While the VPC is attaching or detaching, there is no address there yet.

To connect from inside the VPC, choose Inside the VPC on the Connect tab. The connection strings then use the private address. See Connect to a database.

Change access on an existing database

You can change the allowlist and the VPC while the database is Running.

1. Open Edit Database in one of these ways:
   • On the Overview tab, select Edit beside IP Allowlist.
   • Choose Edit in the database’s row menu on the list, or in the three-dot menu on its details page.
2. Add or remove IP ranges, or choose another VPC, the same way as when you create a database.
3. Select Update Database.

Changing the VPC restarts the database, so you confirm the restart before the change is saved. Open connections are dropped, and applications need to reconnect once the database is back. Changing the allowlist alone keeps the database running.

Each allowlist change is recorded on Activity Timeline as “IP allowlist updated”, with how many address ranges are now allowed.

Check who can connect

On the Overview tab, IP Allowlist gives how many ranges are allowed, and Public Endpoint the address to connect to. On the Connect tab, with Public internet chosen, TIR says who the public endpoint accepts.

Next, connect with the details on the Connect tab. See Connect to a database. For help with a connection that is refused, see Troubleshooting TIR DBaaS.