Updated on 2026-10-30 GMT+08:00

Binding and Unbinding an EIP

Supabase applications support direct EIP binding and unbinding, allowing you to log in to and manage applications over a public network.

If you need fine-grained management of resources on Huawei Cloud, use Identity and Access Management (IAM) to create IAM users and user groups, and grant them specific permissions so that the IAM users can obtain required permissions. For details, see Using IAM Roles or Policies to Grant Access to RDS.

You must use a sign-in account that is assigned the rds:aiApplication:switchEipBind, vpc:publicIps:update, rds:aiApplication:get, and rds:aiApplication:list actions.

You must configure security group rules to allow the private IP addresses and ports that need to access the application. Only then can the application be accessed over a public network. Before accessing a Supabase application, you must add an individual IP address or an IP address range that will access the application to inbound rules. For details, see Configuring a Security Group Rule.
For details about the EIP billing, see EIP Pricing Details.
To enable email authentication over a public network or GitHub authentication, configure outbound rules for the security group to allow the Supabase application to access the public network using the required email server address and port or GitHub address and port.
In the following user authentication (Auth) configuration scenarios, if a Supabase application's EIP is in use, you cannot unbind the EIP directly. You must first manually disable related features and ensure that the Auth configuration is no longer associated with this EIP. Otherwise, Auth may fail or become unavailable, affecting running workloads and causing security or functionality issues.
- GitHub authentication is selected and enabled in Identity Providers (IdPs).
- An email template is configured, and the template file is hosted in Supabase Storage with a URL containing the Supabase application's EIP.
- The Supabase application's EIP is configured as the external access address in access control.

For an application that already has an EIP bound, you must unbind it before binding another EIP.
An EIP cannot be used by another gateway or application. Each EIP can be bound only to one application.
If an application has enabled complete email or GitHub authentication over a public network, do not unbind the EIP. Otherwise, sign-up and sign-in may fail, affecting normal business operations.
A DNAT gateway and an EIP cannot be bound to an application at the same time. Once a DNAT gateway address is bound, you cannot bind an EIP. Similarly, once an EIP is bound, you cannot bind a DNAT gateway address. You must unbind the existing address before binding the other.

If you bind a gateway address using a Huawei Cloud account, no additional configuration is required. If you bind it as an IAM user for the first time, you must be granted permission to create an agency.
When configuring policy-based authorization, use IAM project authorization to bind and unbind gateway addresses. Enterprise project authorization is not supported.

The IAM user must have the following permissions to bind a gateway address.

**Table 1** Permission requirements for the IAM user to bind a gateway address
Current IAM Policy	Required IAM 3.0 Permissions	Required IAM 5.0 Permissions
Role/Policy-based (IAM 3.0)	gaussdb:instance:unbindPublicIp gaussdb:instance:bindPublicIp gaussdb:instance:list nat:dnatRules:create nat:natGateways:list nat:snatRules:list nat:dnatRules:delete nat:natGateways:get nat:dnatRules:get nat:dnatRules:update nat:dnatRules:list If you do not have these permissions, create a custom policy.	eip:publicIps:associateInstance eip:publicIps:disassociateInstance nat:natGateways:listTags If you do not have these permissions, create a custom identity policy and attach it to the principal.
Identity policy-based (IAM 5.0)	N/A	nat:dnatRules:create nat:dnatRules:delete nat:dnatRules:get nat:dnatRules:list nat:dnatRules:update nat:natGateways:get nat:natGateways:list nat:natGateways:listTags nat:snatRules:list eip:publicIps:associateInstance eip:publicIps:disassociateInstance If you do not have these permissions, create a custom identity policy and attach it to the principal.

Log in to the RDS console.
Click in the upper left corner and select a region.
In the navigation pane, choose AI App Dev Platform.
On the AI App Dev Platform page, click the target AI application name to open its details page. You can view the network configuration of the application.

Figure 1 Network configuration of the RDS Supabase application
Click Bind under Elastic IP to bind an EIP.
Select an EIP and click OK.

Figure 2 Binding an EIP to the RDS Supabase application
Return to the Network Info area and check the binding result.

Log in to the RDS console.
Click in the upper left corner and select a region.
In the navigation pane, choose AI App Dev Platform.
On the AI App Dev Platform page, click the target AI application name to open its details page. You can view the network configuration of the application.

Figure 3 Network configuration of the RDS Supabase application
Click Unbind under Elastic IP to unbind the EIP.
In the displayed dialog box, click OK. Wait until the task is complete.
Return to the Network Info area and check the unbinding result.