All Products
Document Center

Cloud Enterprise Network:GrantInstanceToTransitRouter

Last Updated:Mar 25, 2024

Grants a transit router permissions on network instances that belong to another Alibaba Cloud account. To connect a transit router of Account B to a network instance of Account A, you must use Account A to grant permissions to the transit router of Account B.

Operation description

  • GrantInstanceToTransitRouter grants transit routers the permissions to connect only to virtual private clouds (VPCs), virtual border routers (VBRs), and IPsec-VPN connections that belong to another Alibaba Cloud account.

    If you want to grant transit routers permissions to connect to Cloud Connect Network (CCN) instances, call the GrantInstanceToCbn operation.

  • Before you call GrantInstanceToTransitRouter, take note of the billing rules, permission limits, and prerequisites on permission management of transit routers. For more information, see Acquire permissions to connect to a network instance that belongs to another account.


OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

  • Operation: the value that you can use in the Action element to specify the operation on a resource.
  • Access level: the access level of each operation. The levels are read, write, and list.
  • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
    • The required resource types are displayed in bold characters.
    • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
  • Condition Key: the condition key that is defined by the cloud service.
  • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
OperationAccess levelResource typeCondition keyAssociated operation
  • All Resources

Request parameters


Enter the ID of the Cloud Enterprise Network (CEN) instance to which the transit router belongs.


The ID of the network instance.


The type of the network instance. Valid values:

  • VPC: VPC
  • ExpressConnect: VBR
  • VPN: IPsec connection

The ID of the region where the network instance is deployed.

You can call the DescribeChildInstanceRegions operation to query the most recent region list.


The ID of the Alibaba Cloud account to which the CEN instance belongs.


The entity that pays the fees of the network instance. Valid values:

  • PayByCenOwner: the Alibaba Cloud account that owns the CEN instance.
  • PayByResourceOwner: the Alibaba Cloud account that owns the network instance.

Response parameters


The response.


The ID of the request.



Sample success responses


  "RequestId": "C6E5992C-A57B-5A6C-9B26-568074DC68BA"

Error codes

HTTP status codeError codeError messageDescription
400Forbbiden.TransitRouterServiceNotOpenThe user has not open transit router service.The error message returned because the transit router is disabled. Enable the transit router and try again.
400NoPermission.AliyunServiceRoleForCENYou are not authorized to create the service linked role. Role Name: AliyunServiceRoleForCEN. Service Name: Make sure that the user has been granted the ram:CreateServiceLinkedRole permission.The error message because you do not have the permissions to create the service-linked role whose role name is AliyunServiceRoleForCEN and service name is You must acquire the ram:CreateServiceLinkedRole permission before you can create the service-linked role.
400IllegalParam.CenIdThe specified CenId is invalid.The error message returned because the ID of the CEN instance is invalid.
400OperationFailed.TaskConflictThe operation is too frequent, please wait a moment and try again.The error message returned because this operation is performed at a high frequency. Try again later.
400InvalidVbr.NotFoundvbr is not found.-
400InvalidParameterInvalid parameter.The error message returned because the parameter is set to an invalid value.
400UnauthorizedThe AccessKeyId is unauthorized.The error message returned because you do not have the permissions to perform this operation.
404InvalidInstanceId.NotFound InstanceId is not found.-

For a list of error codes, visit the Service error codes.

Change history

Change timeSummary of changesOperation
2023-12-26The Error code has changedsee changesets
Change itemChange content
Error CodesThe Error code has changed.
    delete Error Codes: 400
    delete Error Codes: 404