Call UpdateTrafficMarkingPolicyAttribute to modify a traffic marking policy - Cloud Enterprise Network - Alibaba Cloud - Cloud Enterprise Network

Modifies the name, description, and traffic classification rules of a traffic marking policy.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cen:UpdateTrafficMarkingPolicyAttribute

update

*CenInstance

acs:cen:*:{#accountId}:ceninstance/{#CenId}

None

Request parameters

Parameter	Type	Required	Description	Example
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can generate the token by using the client. Make sure that the token is unique among different requests. The token can be up to 64 ASCII characters in length.	123e4567-e89b-12d3-a456-426****
DryRun	boolean	No	Specifies whether to perform only a dry run. Valid values: true: performs a dry run. The system checks the request without modifying the name, description, or traffic classification rules of the traffic marking policy. The system checks whether required parameters are specified, the request format is valid, and service limits are met. If the request fails the dry run, an error message is returned. If the request passes the dry run, the DryRunOperation error code is returned. false (default): performs a dry run and then sends the request. If the request passes the dry run, the system modifies the name, description, and traffic classification rules of the traffic marking policy.	false
TrafficMarkingPolicyId	string	Yes	The ID of the traffic marking policy.	tm-u9nxup5kww5po8****
TrafficMarkingPolicyName	string	No	The new name of the traffic marking policy. The name can be empty or 1 to 128 characters in length. It cannot start with http:// or https://.	nametest
TrafficMarkingPolicyDescription	string	No	The new description of the traffic marking policy. The description can be empty or 1 to 256 characters in length. It cannot start with http:// or https://.	desctest
AddTrafficMatchRules	array<object>	No	The list of traffic classification rules to be added. You can add up to 50 traffic classification rules at a time.
	object	No	The list of traffic classification rules to be added.
MatchDscp	integer	No	The Differentiated Services Code Point (DSCP) value of the traffic packet. Valid values: 0 to 63. The traffic classification rule matches traffic that contains the specified DSCP value. If you do not specify this parameter, the traffic classification rule matches traffic with any DSCP value. Note The DSCP value refers to the DSCP value carried by the traffic packet before it enters the cross-region connection. You can create up to 50 traffic classification rules at a time. Each traffic classification rule can specify one DSCP value to match.	1
DstCidr	string	No	The destination CIDR block of the traffic packet. Both IPv4 and IPv6 addresses are supported. The traffic classification rule matches traffic whose destination IP address falls within the destination CIDR block. If you do not specify this parameter, the traffic classification rule matches traffic with any destination IP address. You can create up to 50 traffic classification rules at a time. Each traffic classification rule can specify one destination CIDR block.	172.30.0.0/24
TrafficMatchRuleDescription	string	No	The description of the traffic classification rule. You can create up to 50 traffic classification rules at a time. You can add one description to each traffic classification rule. The description can be empty or 1 to 256 characters in length. It cannot start with http:// or https://.	test1
Protocol	string	No	The protocol type of the traffic packet. The traffic marking policy supports matching traffic of various protocol types, such as HTTP, HTTPS, TCP, UDP, SSH, and Telnet. For more protocol types, log on to the Cloud Enterprise Network (CEN) console. Some protocols have fixed ports. Click to view port details. If the protocol type is ICMP, the destination port number must be set to -1. If the protocol type is GRE, the destination port number must be set to -1. If the protocol type is SSH, the destination port number must be set to 22. If the protocol type is Telnet, the destination port number must be set to 23. If the protocol type is HTTP, the destination port number must be set to 80. If the protocol type is HTTPS, the destination port number must be set to 443. If the protocol type is MS SQL, the destination port number must be set to 1443. If the protocol type is Oracle, the destination port number must be set to 1521. If the protocol type is Mysql, the destination port number must be set to 3306. If the protocol type is RDP, the destination port number must be set to 3389. If the protocol type is Postgre SQL, the destination port number must be set to 5432. If the protocol type is Redis, the destination port number must be set to 6379. You can create up to 50 traffic classification rules at a time. Each traffic classification rule can specify one protocol type to match.	UDP
DstPortRange	array	No	The destination port of the traffic packet. Valid values: -1 and 1 to 65535. The traffic classification rule matches traffic whose destination port number falls within the destination port range. If you do not specify this parameter, the traffic classification rule matches traffic with any destination port number. You can enter up to two port numbers for this parameter. The input format is described as follows: If you enter only one port number, such as 1, the system matches traffic whose destination port is 1 by default. If you enter -1, the system matches traffic with any destination port. If you enter two port numbers, such as 1 and 200, the system matches traffic whose destination port falls within the range of 1 to 200 by default. If you enter two port numbers and one of them is -1, the other port number must also be -1, which indicates that the system matches traffic with any destination port. You can create up to 50 traffic classification rules at a time. Each traffic classification rule can specify one destination port range.
	integer	No	The destination port of the traffic packet. Valid values: -1 and 1 to 65535. The traffic classification rule matches traffic whose destination port number falls within the destination port range. If you do not specify this parameter, the traffic classification rule matches traffic with any destination port number. You can enter up to two port numbers for this parameter. The input format is described as follows: If you enter only one port number, such as 1, the system matches traffic whose destination port is 1 by default. If you enter two port numbers, such as 1 and 200, the system matches traffic whose destination port falls within the range of 1 to 200 by default. If you enter two port numbers and one of them is -1, the other port number must also be -1, which indicates that the system matches traffic with any destination port. You can create up to 50 traffic classification rules at a time. Each traffic classification rule can specify one destination port range.	77
SrcCidr	string	No	The source CIDR block of the traffic packet. Both IPv4 and IPv6 addresses are supported. The traffic classification rule matches traffic whose source IP address falls within the source CIDR block. If you do not specify this parameter, the traffic classification rule matches traffic with any source IP address. You can create up to 50 traffic classification rules at a time. Each traffic classification rule can specify one source CIDR block to match.	10.128.32.0/19
SrcPortRange	array	No	The source port of the traffic packet. Valid values: -1 and 1 to 65535. The traffic classification rule matches traffic whose source port number falls within the source port range. If you do not specify this parameter, the traffic classification rule matches traffic with any source port. You can enter up to two port numbers for this parameter. The input format is described as follows: If you enter only one port number, such as 1, the system matches traffic whose source port is 1 by default. If you enter -1, the system matches traffic with any source port. If you enter two port numbers, such as 1 and 200, the system matches traffic whose source port falls within the range of 1 to 200 by default. If you enter two port numbers and one of them is -1, the other port number must also be -1, which indicates that the system matches traffic with any source port. You can create up to 50 traffic classification rules at a time. Each traffic classification rule can specify one source port range.
	integer	No	The source port of the traffic packet. Valid values: -1 and 1 to 65535. The traffic classification rule matches traffic whose source port number falls within the source port range. If you do not specify this parameter, the traffic classification rule matches traffic with any source port. You can enter up to two port numbers for this parameter. The input format is described as follows: If you enter only one port number, such as 1, the system matches traffic whose source port is 1 by default. If you enter two port numbers, such as 1 and 200, the system matches traffic whose source port falls within the range of 1 to 200 by default. If you enter two port numbers and one of them is -1, the other port number must also be -1, which indicates that the system matches traffic with any source port. You can create up to 50 traffic classification rules at a time. Each traffic classification rule can specify one source port range.	22
TrafficMatchRuleName	string	No	The name of the traffic classification rule. You can create up to 50 traffic classification rules at a time. You can add one name to each traffic classification rule. The name can be empty or 1 to 128 characters in length. It cannot start with http:// or https://.	Guangzhou test
AddressFamily	string	No	The address family. Valid values: IPv4 and IPv6. You can also leave this parameter empty.	IPv4
DeleteTrafficMatchRules	array<object>	No	The list of traffic classification rules to be deleted. Note Provide complete information about the traffic classification rules, such as the source CIDR block, destination CIDR block, source port, destination port, and DSCP value. Otherwise, the system may fail to locate the traffic classification rules to be deleted, and the target traffic classification rules will not be deleted.
	object	No	The list of traffic classification rules to be deleted.
MatchDscp	integer	No	The DSCP value of the traffic packet.	3
DstCidr	string	No	The destination CIDR block of the traffic packet. Both IPv4 and IPv6 addresses are supported.	192.168.200.3/32
TrafficMatchRuleDescription	string	No	The description of the traffic classification rule. The description can be empty or 1 to 256 characters in length. It cannot start with http:// or https://.	Hangzhou-Qingdao CAT
Protocol	string	No	The protocol type of the traffic packet. You can call the ListTrafficMarkingPolicies operation to query the details of the traffic classification rules to be deleted.	TCP
DstPortRange	array	No	The destination port of the traffic packet.
	integer	No	The destination port of the traffic packet.	22
SrcCidr	string	No	The source CIDR block of the traffic packet. Both IPv4 and IPv6 addresses are supported.	10.72.0.0/16
SrcPortRange	array	No	The source port of the traffic packet.
	integer	No	The source port of the traffic packet.	23
TrafficMatchRuleName	string	No	The name of the traffic classification rule. The name can be empty or 1 to 128 characters in length. It cannot start with http:// or https://.	test
AddressFamily	string	No	The address family. Valid values: IPv4 and IPv6. You can also leave this parameter empty.	IPv6

Response elements

Element	Type	Description	Example
	object	The response.
RequestId	string	The request ID.	60BB11B2-7BF4-54DC-BCC9-F706E1EB02AC

Examples

Success response

JSON format

{
  "RequestId": "60BB11B2-7BF4-54DC-BCC9-F706E1EB02AC"
}

Error codes

HTTP status code	Error code	Error message	Description
400	InvalidTrafficMarkingPolicyId.NotFound	TrafficMarkingPolicyId is not found.	The error message returned because the specified traffic marking policy ID (TrafficMarkingPolicyId) does not exist.
400	IncorrectStatus.TrafficMarkingPolicy	The status of TrafficMarkingPolicy is incorrect.	The error message returned because the status of the traffic marking policy does not support this operation. Try again later.
400	Duplicated.AddTrafficMatchRules	The parameter AddTrafficMatchRules are duplicated.
400	Duplicated.DeleteTrafficMatchRulese	The parameter DeleteTrafficMatchRules are duplicated.
400	InstanceExist.AddTrafficMatchRules	The instance already exists.	The error message returned because the specified instance already exists.
400	Duplicated.AddTrafficMatchRulesAndDeleteTrafficMatchRules	The same rule in AddTrafficMatchRules and DeleteTrafficMatchRules is not supported..	The error message returned because the AddTrafficMatchRules and DeleteTrafficMatchRules cannot specify the same route. Delete duplicate routes and try again.
400	IllegalParam.DstPortRange	The specified DstPortRange is illegal.	The specified DstPortRange is illegal.
400	IllegalParam.SrcPortRange	The specified SrcPortRange is illegal.	The source port is invalid.
400	AttrMismatching.CidrAddressFamily	Attribute SrcCidr or DstCidr of TrafficMarkRule does not match AddressFamily.	Attribute SrcCidr or DstCidr of TrafficMarkRule does not match AddressFamily.
400	IllegalParam.AddressFamily	AddressFamily is illegal.	The AddressFamily value of the request parameter is invalid. Valid values are IPv4 or IPv6.
400	AttrMismatching.SrcCidrDstCidr	Attribute SrcCidr of TrafficMarkRule does not match DstCidr.	Attribute SrcCidr of TrafficMarkRule does not match DstCidr.
400	AttrMismatching.CidrProtocol	Attribute SrcCidr or DstCidr of TrafficMarkRule does not match Protocol.	Attribute SrcCidr or DstCidr of TrafficMarkRule does not match Protocol.
400	InvalidTransitRouterMode.NeedUpgrade	TransitRouter need to upgrade.	The error message returned because the specified transit router mode is not supported.
400	OperationUnsupported.SrcPortRange	Current TR version does not support setting source port range.	Current TR version does not support setting source port range
400	OperationUnsupported.DstPortRange	Current TR version does not support setting destination port range.	Current TR version does not support setting destination port range.
400	OperationUnsupported.IPv6Cidr	The traffic marking policy for current TR type does not support IPv6 CIDR.	The flow classification rules in the flow marking policy of the basic version forwarding router do not support IPv6 network segments.
400	IllegalParam.DstCidr	DstCidr is illegal.	The error message returned because the specified destination CIDR block (DstCidr) is invalid.
400	IllegalParam.SrcCidr	SrcCidr is illegal.	The error message returned because the specified source CIDR block is invalid.
400	InvalidParameter	Invalid parameter.	The error message returned because the parameter is set to an invalid value.
400	Unauthorized	The AccessKeyId is unauthorized.	The error message returned because you do not have the permissions to perform this operation.
400	MissingParam.TrafficMarkingPolicyId	The parameter TrafficMarkingPolicyId is mandatory.	The parameter TrafficMarkingPolicyId is mandatory.
400	InvalidParameter.TrafficMarkingPolicyId	The specified parameter TrafficMarkingPolicyId is invalid.	The parameter TrafficMarkingPolicyId entered is illegal.
404	InvalidDeleteTrafficMatchRules.NotFound	The specified DeleteTrafficMatchRules are not found.	The error message returned because the value of the DeleteTrafficMatchRules parameter does not exist.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.