TMA-TDSQL-5.10
Ensure the OSS API Allowlist Is Configured
MediumLevel 2Manual reviewtdsql
Description
TDSQL OSS supports an IP allowlist for API callers, restricting management API access to specific IP addresses.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Check the allowlist configuration in scheduler.xml: <whitelist ip="..." .../> Confirm the ip field is not empty.
How it is fixed
Fix method: Guidance or infrastructure patch
Configure the allowlist IP list (allowing only the management/operations subnets): <whitelist ip="10.0.1.0/24;10.0.2.100" .../>
Properties
- Operating systems
- Any
- Tags
- tdsqlnetworkoss
- Reference
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 5.10 Ensure the OSS API Allowlist Is Configured