All Products
Search

This Product

    Cloud Enterprise Network:Cross-account authorization for network instances

    Document Center

    Cloud Enterprise Network:Cross-account authorization for network instances

    Last Updated:Oct 12, 2026

    To connect a transit router (TR) to a network instance that belongs to another Alibaba Cloud account, the owner of the network instance must first authorize the transit router instance. This topic describes how to authorize a VPC instance, VBR instance, CCN instance, IPsec-VPN connection, or ECR instance for a transit router, how to change the payer of a network instance, and how to revoke the authorization.

    Billing

    After an Enterprise Edition transit router is connected to a VPC instance, VBR instance, IPsec-VPN connection, or ECR instance, network instance attachment fees and data forwarding fees are charged. When you authorize a network instance, you choose which account pays these fees: the account that owns the network instance, or the account that owns the Enterprise Edition transit router instance. For more information, see Billing overview.

    Limits

    • A transit router instance that belongs to an Alibaba Cloud China site account can connect only to network instances that belong to Alibaba Cloud China site accounts. A transit router instance that belongs to an Alibaba Cloud international site account can connect only to network instances that belong to Alibaba Cloud international site accounts.

    • After an Enterprise Edition transit router instance is connected to a cross-account network instance, you must change the payer in both the resource account and the transit router account. The change takes effect at the top of the next hour. For more information, see Change the payer for a network instance.

    Prerequisites

    Before you authorize a network instance, make sure that you have completed the following tasks:

    • Confirm that the account that owns the network instance and the account that owns the transit router instance are of the same type.

      A transit router instance that belongs to an Alibaba Cloud China site account can connect only to network instances that belong to Alibaba Cloud China site accounts. A transit router instance that belongs to an Alibaba Cloud international site account can connect only to network instances that belong to Alibaba Cloud international site accounts.

    • Obtain the ID of the Alibaba Cloud account (primary account) that owns the transit router instance.

    • Obtain the ID of the CEN instance to which the transit router instance belongs.

    • To authorize a VBR instance, apply for VBR instance authorization permissions. For instructions, see Connect a VBR to a cross-account CEN.

    • To authorize an IPsec-VPN connection, make sure that the IPsec-VPN connection is not attached to any resource:

      • If the IPsec-VPN connection is attached to a VPN Gateway instance, it cannot be attached to a transit router instance in the same account or another account.

      • If the IPsec-VPN connection is attached to a transit router instance, detach it first. For instructions, see Delete a network instance connection.

    Scenario

    This topic uses the scenario in the following figure to describe network instance authorization. A transit router instance in Account B needs to connect to VPC instances, VBR instances, CCN instances, IPsec-VPN connections, and ECR instances in Account A. The following sections describe how Account A authorizes the transit router instance in Account B to connect to these resources.

    image

    The following table lists the console that you use to authorize each type of network instance and whether the payer can be changed after authorization.

    Network instance

    Authorization console

    Change the payer

    VPC instance

    VPC console

    Supported

    VBR instance

    Express Connect console

    Supported

    CCN instance

    Smart Access Gateway console

    Not supported

    IPsec-VPN connection

    VPN Gateway console

    Supported

    ECR instance

    Express Connect console

    Not supported

    Authorize a network instance

    Authorize a VPC instance

    1. Log on to the VPC console with Account A.

    2. In the top menu bar, select the region of the target VPC instance.

    3. On the VPC page, find the target VPC instance and click the instance ID.

    4. Click the Cross-account Authorization tab. On the CEN tab, click Cross-account Authorization.

    5. In the Attach to CEN dialog box, configure the following settings and click OK.

      Configuration item

      Description

      Peer Account UID

      The ID of the Alibaba Cloud account (primary account) that owns the transit router instance.

      Peer CEN Instance ID

      The ID of the CEN instance to which the transit router instance belongs.

      Payer

      Select a payer.

      • CEN Instance Owner (default): The account that owns the transit router instance pays the network instance attachment fee and data forwarding fee incurred by the VPC instance.

      • VPC Users: The account that owns the VPC instance pays the network instance attachment fee and data forwarding fee incurred by the VPC instance.

      After the configuration is complete, the authorization is successful. You can view the authorization information on the Cross-account Authorization tab.

    6. Record the VPC ID and the account ID of Account A. You need this information to create a VPC connection later. For instructions, see Create a VPC connection.

      You can view the account ID on the Account Center page.

    Authorize a VBR instance

    Authorize a VBR instance

    1. Log on to the Express Connect console with Account A.

    2. In the top menu bar, select the region of the target VBR instance.

    3. In the left-side navigation pane, click Virtual Border Routers (VBRs).

    4. On the Virtual Border Routers (VBRs) page, click the target VBR instance ID.

    5. Click the CEN Authorization tab. On this tab, click Authorize CEN of Another Account to Load Instance.

    6. In the Authorize CEN of Another Account to Load Instance panel, configure the following settings and click OK.

      Configuration item

      Description

      CEN Instance ID

      The ID of the CEN instance to which the transit router instance belongs.

      CEN Account

      The ID of the Alibaba Cloud account (primary account) that owns the transit router instance.

      Payer

      Select a payer.

      • CEN Instance Owner (default): The account that owns the transit router instance pays the network instance attachment fee and data forwarding fee incurred by the VBR instance.

      • VBR Owner: The account that owns the VBR instance pays the network instance attachment fee and data forwarding fee incurred by the VBR instance.

      After the configuration is complete, the authorization is successful. You can view the authorization information on the CEN Authorization tab.

    7. Record the VBR ID and the account ID of Account A. You need this information to create a VBR connection later. For instructions, see Connect a VBR to a transit router.

      You can view the account ID on the Account Center page.

    Authorize a CCN instance

    Authorize a CCN instance

    1. Log on to the Smart Access Gateway console with Account A.

    2. In the top menu bar, select the region of the target CCN instance.

    3. In the left-side navigation pane, click CCN.

    4. On the CCN page, click the target CCN instance ID.

    5. On the CCN instance details page, click the CEN Cross Account Authorization Information tab. On this tab, click CEN Cross Account Authorization.

    6. In the Attach to CEN dialog box, enter the account ID and the CEN instance ID of Account B, and click OK.

      After the configuration is complete, the authorization is successful. You can view the authorization information on the CEN Cross Account Authorization Information tab.

    7. Record the CCN ID and the account ID of Account A. You need this information to create a CCN connection later. For instructions, see Create a CCN connection.

      You can view the account ID on the Account Center page.

    Authorize an IPsec-VPN connection

    Authorize an IPsec-VPN connection

    1. Log on to the VPN Gateway console.

    2. In the left navigation pane, choose Interconnections > VPN > IPsec Connections.

    3. In the top navigation bar, select the region of the IPsec-VPN connection.

    4. On the IPsec Connections page, find the target IPsec-VPN connection and click the IPsec-VPN connection ID.

    5. On the Cross-account Authorization tab of the IPsec-VPN connection details page, click Cross-account Authorization.

    6. In the Attach to CEN dialog box, configure the following settings and click OK.

      Configuration item

      Description

      Peer Account UID

      The ID of the Alibaba Cloud account (primary account) that owns the transit router instance.

      Peer CEN Instance ID

      The ID of the CEN instance to which the transit router instance belongs.

      Payer

      Select a payer.

      • CEN Instance Owner (default): The account that owns the transit router instance pays the network instance attachment fee and data forwarding fee incurred after the transit router instance is attached to the IPsec-VPN connection.

      • VPN Owner: The account that owns the IPsec-VPN connection pays the network instance attachment fee and data forwarding fee incurred after the transit router instance is attached to the IPsec-VPN connection.

      Important

      • The account that owns the IPsec-VPN connection remains responsible for the IPsec-VPN connection instance fee and IPsec-VPN connection data transfer fee incurred after the transit router instance is attached to the IPsec-VPN connection.

      After the configuration is complete, the authorization is successful. You can view the authorization information on the Cross-account Authorization tab.

    7. Record the IPsec-VPN connection ID and the ID of the Alibaba Cloud account (primary account) that owns the IPsec-VPN connection. You need this information to create an IPsec-VPN connection later. For instructions, see Create a VPN connection.

      You can view the account ID on the Account Center page.

    Authorize an ECR instance

    Authorize an ECR instance

    1. Log on to the Express Connect console with Account A.

    2. In the left-side navigation pane, click Express Connect Router (ECR).

    3. On the Express Connect Router (ECR) page, click the target ECR instance ID.

    4. Click the CEN Authorization tab. On this tab, click Authorize CEN of Another Account to Load Instance.

    5. In the Join CEN dialog box, configure the following settings and click OK.

      Configuration item

      Description

      CEN Instance ID

      The ID of the CEN instance to which the transit router instance belongs.

      CEN Account

      The ID of the Alibaba Cloud account (primary account) that owns the transit router instance.

      Payer

      Select a payer.

      • CEN Owner (default): The account that owns the transit router instance pays the network instance attachment fee and data forwarding fee incurred by the ECR instance.

      • ECR Owner: The account that owns the ECR instance pays the network instance attachment fee and data forwarding fee incurred by the ECR instance.

      After the configuration is complete, the authorization is successful. You can view the authorization information on the CEN Authorization tab.

    6. Record the ECR ID and the account ID of Account A. You need this information to create an ECR connection later. For instructions, see Create an ECR connection.

      You can view the account ID on the Account Center page.

    Change the payer for a network instance

    Only VPC instances, VBR instances, and IPsec-VPN connections support changing the payer. ECR instances do not currently support this operation. The procedure that you use depends on whether an Enterprise Edition transit router is already connected to the cross-account network instance:

    • If an Enterprise Edition transit router is not connected to the cross-account network instance, revoke the authorization in the resource account (the account that owns the network instance) and then create the authorization again.

    • If an Enterprise Edition transit router is connected to the cross-account network instance, change the payer in the resource account first, and then change the payer on the transit router side. The change takes effect at the top of the next hour.

      You can change the payer in the console or by calling API operations. The console procedure uses a cross-account VPC instance as an example. The API procedure lists the operations for VPC instances, VBR instances, and IPsec-VPN connections.

    Console

    The following example changes the payer for a cross-account VPC instance. The assumptions are as follows:

    • Account A is the owner of the VPC instance, and Account B is the owner of the CEN instance and the transit router instance.

    • Account B is the current payer (CEN Instance Owner).

      To change the payer to Account A (VPC Users), perform the following steps:

    1. Log on to Account A. On the details page of the target VPC instance, click the Cross-account Authorization tab. In the Payer column of the target authorization entry, click Edit and select VPC Users.

    2. Log on to Account B and go to the target transit router. In the Payer Account column of the target VPC connection, click Edit and select Resource Owner Account.

    3. Wait until the top of the next hour for the change to take effect.

    API

    1. Log on to the resource account and call ModifyGrantInstanceToTransitRouter. Set OrderType to the target payer.

    2. Log on to the transit router account and change the payer:

    3. Wait until the top of the next hour for the change to take effect. To verify the result, log on to the transit router account and call DescribeGrantRulesToCen, and then confirm that EffectiveOrderType is the target payer.

    Revoke network instance authorization

    Before you revoke the authorization of a network instance, detach the transit router instance from the network instance. For instructions, see Delete a network instance connection.

    Revoke VPC instance authorization

    1. Log on to the VPC console with Account A.

    2. In the top menu bar, select the region of the target VPC instance.

    3. On the VPC page, find the target VPC instance and click the instance ID.

    4. Click the Cross-account Authorization tab. On the CEN tab, find the target authorization record and, in the Actions column, click Revoke Permissions.

    5. In the Revoke Permissions dialog box, confirm the information and click OK.

    Revoke VBR instance authorization

    1. Log on to the Express Connect console with Account A.

    2. In the top menu bar, select the region of the target VBR instance.

    3. In the left-side navigation pane, click Virtual Border Routers (VBRs).

    4. On the Virtual Border Routers (VBRs) page, click the target VBR instance ID.

    5. Click the CEN Authorization tab. On this tab, find the target authorization record and, in the Actions column, click Delete.

    6. In the Revoke Authorization dialog box, confirm the information and click OK.

    Revoke CCN instance authorization

    1. Log on to the Smart Access Gateway console with Account A.

    2. In the top menu bar, select the region of the target CCN instance.

    3. In the left-side navigation pane, click CCN.

    4. On the CCN page, click the target CCN instance ID.

    5. Click the CEN Cross Account Authorization Information tab. On this tab, find the target authorization record and, in the Actions column, click Revoke Authorization.

    6. In the Note dialog box, confirm the information and click OK.

    Revoke IPsec-VPN connection authorization

    1. Log on to the VPN Gateway console with Account A.

    2. In the top menu bar, select the region of the target IPsec-VPN connection.

    3. In the left-side navigation pane, choose Network Interconnection > VPN > IPsec Connections.

    4. On the IPsec Connections page, find the target IPsec-VPN connection and click the IPsec-VPN connection ID.

    5. On the Cross-account Authorization tab of the IPsec-VPN connection details page, find the target authorization record and, in the Actions column, click Revoke Permissions.

    6. In the Revoke Permissions dialog box, confirm the information and click OK.

    Revoke ECR connection authorization

    1. Log on to the Express Connect console with Account A.

    2. In the left-side navigation pane, click Express Connect Router (ECR).

    3. On the Express Connect Router (ECR) page, click the target ECR instance ID.

    4. Click the CEN Authorization tab. On this tab, find the target authorization record and, in the Actions column, click Delete.

    5. In the Revoke Authorization dialog box, confirm the information and click OK.