Use RoutePrivateZoneInCenToVpc to configure PrivateZone service - Cloud Enterprise Network - Alibaba Cloud - Cloud Enterprise Network

Configures the PrivateZone service by calling the RoutePrivateZoneInCenToVpc operation.

Operation description

PrivateZone is a private DNS resolution and management service based on the Alibaba Cloud Virtual Private Cloud (VPC) environment. After a Virtual Border Router (VBR) instance or a Cloud Connect Network (CCN) instance is attached to a Cloud Enterprise Network (CEN) instance, the associated on-premises network can access the PrivateZone service through CEN.

On-premises networks associated with VBR instances and CCN instances can access only the PrivateZone service in the same region.

For example, if the PrivateZone service is deployed in the China (Beijing) region, only on-premises networks associated with VBR instances in the China (Beijing) region and CCN instances in the Chinese mainland can access the PrivateZone service.
The RoutePrivateZoneInCenToVpc operation is asynchronous. After you send a request, the system returns a RequestId but the PrivateZone service configuration is not complete. The configuration task continues to run in the background. You can call the DescribeCenPrivateZoneRoutes operation to query the status of the PrivateZone service.
- If the PrivateZone service is in the Creating state, the configuration is being added. In this state, you can only query the PrivateZone service configuration. You cannot perform other operations.
- If the PrivateZone service is in the Active state, the configuration is complete.
- If the PrivateZone service is in the Failed state, the configuration failed to be added.

Before you begin

Before you invoke the RoutePrivateZoneInCenToVpc operation, make sure that the following conditions are met:

The PrivateZone service is deployed. For more information, see Alibaba Cloud DNS PrivateZone Getting Started.
The VPC-connected instance associated with the PrivateZone service, and the VBR instance or CCN instance in the access region are attached to the same CEN instance. For more information, see AttachCenChildInstance.
If your on-premises network uses a CCN instance to connect to Alibaba Cloud, and the CCN instance belongs to a different account from the VPC-connected instance or the CEN instance, complete the authorization for the CCN instance first. For more information, see Cloud Connect Network authorization.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cen:RoutePrivateZoneInCenToVpc

create

*CenInstance

acs:cen:*:{#accountId}:ceninstance/{#ceninstanceId}

None

Request parameters

Parameter	Type	Required	Description	Example
CenId	string	Yes	The CEN instance ID.	cen-7qthudw0ll6jmc****
AccessRegionId	string	Yes	The ID of the region that accesses the PrivateZone service. The access region is the region from which the PrivateZone service is accessed. You can call the DescribeChildInstanceRegions operation to query region IDs.	cn-hangzhou
HostRegionId	string	Yes	The ID of the region where the PrivateZone service is deployed.	cn-hangzhou
HostVpcId	string	Yes	The VPC-connected instance ID associated with the PrivateZone service.	vpc-bp1h8vbrbcgohcju5****

Response elements

Element	Type	Description	Example
	object
RequestId	string	The request ID.	C0245BEF-52AC-44A8-A776-EF96FD26A5CA

Examples

Success response

JSON format

{
  "RequestId": "C0245BEF-52AC-44A8-A776-EF96FD26A5CA"
}

Error codes

HTTP status code	Error code	Error message	Description
400	OperationUnsupported.CrossRegionNotSupport	Operation Failed. Host region Id is not equal to access region Id, VPC or VBR not support cross region privatezone service.	The host region ID is different from the service region ID. The VPC or VBR does not support PrivateZone across regions.
400	Forbidden.PrivatezoneServiceNotAuthorize	Privatezone service not to grant authorization.	The error message returned because PrivateZone does not have the required permissions.
400	ParameterIllegal.AccessRegionIdNoCCN	Parameter Access RegionId illegal.
400	InvalidParameter	Invalid parameter.	The error message returned because the parameter is set to an invalid value.
400	Unauthorized	The AccessKeyId is unauthorized.	The error message returned because you do not have the permissions to perform this operation.
400	InvalidParameter.CenId	The specified parameter CenId is invalid.
403	InvalidOperation.PvtzNotAssociatedWithVpc	Privatezone not associated with the specified vpc.	The error message returned because PrivateZone is not associated with the specified VPC.
409	InvalidOperation.PrivatezoneRouteExisted	Privatezone routes already existed.	The error message returned because the PrivateZone route already exists.
409	InvalidOperation.VpcNotAttachedToCen	Vpc not attached to cen.	The error message returned because the specified VPC is not attached to a CEN instance.
409	InvalidOperation.UnmatchRouteInVpcRegion	Operation Failed.Unmatch route in vpc region.	The VPC routes do not match the match conditions.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.