All Products
Document Center

Cloud Enterprise Network:RoutePrivateZoneInCenToVpc

Last Updated:Mar 25, 2024

Configures PrivateZone.

Operation description

Alibaba Cloud DNS PrivateZone (PrivateZone) is an Alibaba Cloud private domain name resolution and management service based on Virtual Private Cloud (VPC). After you attach virtual border routers (VBRs) and Cloud Connect Network (CCN) instances to a Cloud Enterprise Network (CEN) instance, you can enable the on-premises networks connected to the VBRs and CCN instances to access PrivateZone through the CEN instance.

Usage notes

  • The on-premises networks connected to VBRs or CCN instances must be deployed in the same region as the PrivateZone service. For example, if the PrivateZone service is deployed in the China (Beijing) region, only on-premises networks connected to VBRs or CCN instances in the China (Beijing) region can access the PrivateZone service.
  • RoutePrivateZoneInCenToVpc is an asynchronous operation. After you send a request, the request ID is returned but the operation is still being performed in the system background. You can call DescribeCenPrivateZoneRoutes to query the status of PrivateZone.
    • If PrivateZone is in the Creating state, access to PrivateZone is being configured. In this case, you can query PrivateZone configurations but cannot perform other operations.
    • If PrivateZone is in the Active state, access to PrivateZone is enabled.
    • If PrivateZone is in the Failed state, configurations of access to PrivateZone failed.


Before you call RoutePrivateZoneInCenToVpc, make sure that the following conditions are met:

  • PrivateZone is deployed. For more information, see PrivateZone quick start.
  • The following network instances are attached to the same CEN instance: the VPC that is associated with the PrivateZone service, and the VBR and CCN instance that want to access the PrivateZone service. For more information, see AttachCenChildInstance .
  • If your on-premises network uses a CCN instance to connect to Alibaba Cloud and the account that owns the CCN instance is different from the account that owns the VPC or CEN instance, you must grant the CCN instance required permissions. For more information, see Grant permissions to CCN.


OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer.

Authorization information

The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:

  • Operation: the value that you can use in the Action element to specify the operation on a resource.
  • Access level: the access level of each operation. The levels are read, write, and list.
  • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
    • The required resource types are displayed in bold characters.
    • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
  • Condition Key: the condition key that is defined by the cloud service.
  • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
OperationAccess levelResource typeCondition keyAssociated operation
  • CenInstance

Request parameters


The ID of the CEN instance.


The ID of the region where PrivateZone is accessed.

This region refers to the region in which PrivateZone is accessed by clients.

You can call the DescribeChildInstanceRegions operation to query the most recent region list.


The ID of the region where PrivateZone is deployed.


The ID of the VPC that is associated with PrivateZone.


Response parameters


The ID of the request.



Sample success responses


  "RequestId": "C0245BEF-52AC-44A8-A776-EF96FD26A5CA\t"

Error codes

HTTP status codeError codeError messageDescription
400OperationUnsupported.CrossRegionNotSupportOperation Failed. Host region Id is not equal to access region Id, VPC or VBR not support cross region privatezone service.The host region ID is different from the service region ID. The VPC or VBR does not support PrivateZone across regions.
400Forbidden.PrivatezoneServiceNotAuthorizePrivatezone service not to grant authorization.The error message returned because PrivateZone does not have the required permissions.
400ParameterIllegal.AccessRegionIdNoCCN Parameter Access RegionId illegal.-
400InvalidParameterInvalid parameter.The error message returned because the parameter is set to an invalid value.
400UnauthorizedThe AccessKeyId is unauthorized.The error message returned because you do not have the permissions to perform this operation.
403InvalidOperation.PvtzNotAssociatedWithVpcPrivatezone not associated with the specified vpc.The error message returned because PrivateZone is not associated with the specified VPC.
409InvalidOperation.PrivatezoneRouteExistedPrivatezone routes already existed.The error message returned because the PrivateZone route already exists.
409InvalidOperation.VpcNotAttachedToCenVpc not attached to cen.The error message returned because the specified VPC is not attached to a CEN instance.
409InvalidOperation.UnmatchRouteInVpcRegionOperation Failed.Unmatch route in vpc region.The VPC routes do not match the match conditions.

For a list of error codes, visit the Service error codes.

Change history

Change timeSummary of changesOperation
2022-12-22The Error code has changedsee changesets
Change itemChange content
Error CodesThe Error code has changed.
    Error Codes 400 change
    Error Codes 409 change
    delete Error Codes: 403