Use ResolveAndRouteServiceInCen to connect an on-premises network to a cloud service - Cloud Enterprise Network - Alibaba Cloud - Cloud Enterprise Network

Configures a cloud service to add access configurations for on-premises networks by calling the ResolveAndRouteServiceInCen operation.

Operation description

Cloud services refer to Alibaba Cloud services that use the 100.64.0.0/10 CIDR block, such as Object Storage Service (OSS), Simple Log Service (SLS), and Data Transmission Service (DTS). If your on-premises network needs to access cloud services, you must load the Virtual Border Router (VBR) instance or Cloud Connect Network (CCN) instance associated with your on-premises network to a Cloud Enterprise Network (CEN) instance. You must also load a VPC-connected instance in the region where the cloud service resides to the same CEN instance. After loading, your on-premises network can access the VPC-connected instance in the region of the cloud service through CEN, and then access the cloud service through the VPC by forwarding traffic. The CEN handles the routing accordingly.

Limits: This operation applies only to Basic Edition transit routers. On-premises networks associated with VBR instances can access only cloud services in the same region through CEN.

For example, if the cloud service resides in the China (Beijing) region, only on-premises networks associated with VBR instances in the China (Beijing) region can access the cloud service.
The ResolveAndRouteServiceInCen operation is asynchronous. After you send a request, the system returns a RequestId but the cloud service configuration is not yet complete. The background node for adding the configuration continues to run. You can invoke the DescribeRouteServicesInCen operation to query the status of the cloud service.
- If the cloud service is in the Creating state, the cloud service configuration is being added. In this state, you can only execute a query on the cloud service configuration and cannot execute other operations.
- If the cloud service is in the Active state, the cloud service configuration is added.
- If the cloud service is in the Failed state, the cloud service configuration failed to be added.

Before you begin

Before you invoke the ResolveAndRouteServiceInCen operation, make sure that the following conditions are met:

The VBR or CCN instance with network connectivity to your on-premises network is loaded to the CEN instance.
A VPC-connected instance in the region where the cloud service resides is loaded to the CEN instance. For more information, see AttachCenChildInstance.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cen:ResolveAndRouteServiceInCen

create

*CenInstance

acs:cen:*:{#accountId}:ceninstance/{#ceninstanceId}

None

Request parameters

Parameter	Type	Required	Description	Example
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The token can contain only ASCII characters. Note If you do not specify this parameter, the system automatically uses the RequestId of the API request as the ClientToken. The RequestId may be different for each API request.	02fb3da4****
CenId	string	Yes	The CEN instance ID.	cen-ckwa2hhmuislse****
Host	string	Yes	The IP address or CIDR block of the cloud service. Note Cloud services typically use multiple IP addresses or CIDR blocks. Call this operation repeatedly to add all IP addresses or CIDR blocks of the cloud service.	100.118.28.0/24
HostRegionId	string	Yes	The region ID of the cloud service.	cn-hangzhou
HostVpcId	string	Yes	The VPC-connected instance ID associated with the cloud service.	vpc-o6woh5s494zueq40v****
Description	string	No	The description of the cloud service. The description can be empty or 1 to 256 characters in length and cannot start with http:// or https://.	descname
AccessRegionIds	array	Yes	The list of region IDs that access the cloud service.	cn-hangzhou
	string	No	The region ID that accesses the cloud service. You can call the DescribeChildInstanceRegions operation to query region IDs.	cn-hangzhou

Response elements

Element	Type	Description	Example
	object
RequestId	string	The request ID.	C0245BEF-52AC-44A8-A776-EF96FD26A5CA

Examples

Success response

JSON format

{
  "RequestId": "C0245BEF-52AC-44A8-A776-EF96FD26A5CA"
}

Error codes

HTTP status code	Error code	Error message	Description
400	ParameterIllegal.Ipv6CloudRouteCidrNotAllow	Parameter Host not in valid ipv6 cidr.	The error message returned because the specified cloud service routes do not support IPv6.
400	ParameterIllegal.AccessRegionId	Parameter Access RegionId illegal.	The error message returned because the specified access region ID (AccessRegionId) is invalid.
400	ParameterIllegal.CloudRouteHost	Parameter Host is not valid.	The error message returned because the specified cloud route host (CloudRouteHost) is invalid.
400	ParameterIllegal.ClouteRouteNotSupportIpv6	Parameter Host not support IPv6	The error message returned because the specified cloud service routes do not support IPv6.
400	ParameterIllegal.ClouteRouteCidrNotAllow	Parameter Host not in 100.64.0.0/10	The error message returned because the specified cloud service CIDR block is invalid.
400	CloudRoute.Exist	The Specified Cloud Route already Exists	The error message returned because the cloud service route already exists.
400	ParameterIllegal.Host	Parameter Host does not support domain.
400	CloudRoute.Conflict	The Specified Cloud Route Conflicts.	The error message returned because the routes of the cloud services conflict with each other.
400	CloudRoute.VpcNotAttached	The Specified Vpc instance is not attached to CEN.
400	OperationUnsupported.TransitRouterType	The specified TransitRouterType does not support the operation.	The error message returned because this operation is not supported by the specified type of transit router.
400	ParameterIllegal.AccessRegionIdNoCCN	Parameter Access RegionId illegal.	The error message returned because the specified access region ID (AccessRegionId) is invalid.
400	IncorrectStatus.TransitRouter	The resource is not in a valid state for the operation.	The CEN TR instance is not in a valid state for the operation. Please try again later.
400	InvalidOperation.InstanceNotSupportIPv6Route	IPv6 routing has not been enabled for the CEN instance.	IPv6 routing is disabled for CEN.
400	InvalidParameter	Invalid parameter.	The error message returned because the parameter is set to an invalid value.
400	Unauthorized	The AccessKeyId is unauthorized.	The error message returned because you do not have the permissions to perform this operation.
400	InvalidParameter.CenId	The specified parameter CenId is invalid.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.