Use RoutePrivateZoneInCenToVpc to configure PrivateZone service - Cloud Enterprise Network - Alibaba Cloud - Cloud Enterprise Network

Configures the PrivateZone service.

Operation description

PrivateZone is a private DNS domain name resolution and management service based on the Alibaba Cloud Virtual Private Cloud (VPC) environment. After a Virtual Border Router (VBR) instance or a Cloud Connect Network (CCN) instance is attached to a Cloud Enterprise Network (CEN) instance, the associated on-premises networks can access the PrivateZone service through the CEN instance.

The on-premises networks associated with VBR and CCN instances can only access the PrivateZone service in the same region.

For example, if the PrivateZone service is located in the China (Beijing) region, only the on-premises networks associated with VBR instances in the China (Beijing) region and CCN instances in the Chinese mainland can access the PrivateZone service.
The RoutePrivateZoneInCenToVpc operation is asynchronous. The system first returns a RequestId, but the PrivateZone service configuration is not yet complete, and the background task is still running. You can call the DescribeCenPrivateZoneRoutes operation to query the status of the PrivateZone service.
- When the PrivateZone service is in the Creating state, the PrivateZone service configuration is being added. In this state, you can only query the PrivateZone service configuration and cannot perform other operations.
- When the PrivateZone service is in the Active state, the PrivateZone service configuration is added.
- When the PrivateZone service is in the Failed state, the PrivateZone service configuration fails to be added.

Before you begin

Before you invoke the RoutePrivateZoneInCenToVpc operation, make sure that the following conditions are met:

The PrivateZone service deployment is complete. For more information, see Quick start for PrivateZone DNS parse.
Make sure that you load the VPC-connected instance associated with the PrivateZone service, and the VBR or CCN instance in the access region to the same CEN instance. For more information, see AttachCenChildInstance.
If your on-premises network is connected to Alibaba Cloud by using a CCN instance, and the account to which the CCN instance belongs is different from the account to which the VPC-connected instance or the CEN instance belongs, you must first complete the authorization for the CCN instance. For more information, see Authorize a Cloud Connect Network.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cen:RoutePrivateZoneInCenToVpc

create

*CenInstance

acs:cen:*:{#accountId}:ceninstance/{#ceninstanceId}

None

Request parameters

Parameter	Type	Required	Description	Example
CenId	string	Yes	The Cloud Enterprise Network (CEN) instance ID.	cen-7qthudw0ll6jmc****
AccessRegionId	string	Yes	The ID of the region where the PrivateZone service is accessed. The access region refers to the region where the PrivateZone service is accessed. You can call the DescribeChildInstanceRegions operation to obtain the region ID.	cn-hangzhou
HostRegionId	string	Yes	The ID of the region where the PrivateZone service is deployed.	cn-hangzhou
HostVpcId	string	Yes	The VPC-connected instance ID associated with the PrivateZone service.	vpc-bp1h8vbrbcgohcju5****

Response elements

Element	Type	Description	Example
	object
RequestId	string	The request ID.	C0245BEF-52AC-44A8-A776-EF96FD26A5CA

Examples

Success response

JSON format

{
  "RequestId": "C0245BEF-52AC-44A8-A776-EF96FD26A5CA"
}

Error codes

HTTP status code	Error code	Error message	Description
400	OperationUnsupported.CrossRegionNotSupport	Operation Failed. Host region Id is not equal to access region Id, VPC or VBR not support cross region privatezone service.	The host region ID is different from the service region ID. The VPC or VBR does not support PrivateZone across regions.
400	Forbidden.PrivatezoneServiceNotAuthorize	Privatezone service not to grant authorization.	The error message returned because PrivateZone does not have the required permissions.
400	ParameterIllegal.AccessRegionIdNoCCN	Parameter Access RegionId illegal.
400	InvalidParameter	Invalid parameter.	The error message returned because the parameter is set to an invalid value.
400	Unauthorized	The AccessKeyId is unauthorized.	The error message returned because you do not have the permissions to perform this operation.
400	InvalidParameter.CenId	The specified parameter CenId is invalid.	The entered parameter CenId is invalid.
403	InvalidOperation.PvtzNotAssociatedWithVpc	Privatezone not associated with the specified vpc.	The error message returned because PrivateZone is not associated with the specified VPC.
409	InvalidOperation.PrivatezoneRouteExisted	Privatezone routes already existed.	The error message returned because the PrivateZone route already exists.
409	InvalidOperation.VpcNotAttachedToCen	Vpc not attached to cen.	The error message returned because the specified VPC is not attached to a CEN instance.
409	InvalidOperation.UnmatchRouteInVpcRegion	Operation Failed.Unmatch route in vpc region.	The VPC routes do not match the match conditions.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.