Grants a transit router permissions on network instances that belong to another Alibaba Cloud account. To connect a transit router of Account B to a network instance of Account A, you must use Account A to grant permissions to the transit router of Account B.
Operation description
-
The
GrantInstanceToTransitRouteroperation can be used to grant transit routers permissions on network instances that belong to other Alibaba Cloud accounts, including virtual private clouds (VPCs), virtual border routers (VBRs), IPsec-VPN connections, and Express Connect Router (ECRs).To grant transit routers permissions on Cloud Connect Network (CCN) instances, call the GrantInstanceToCbn operation.
-
Before you call
GrantInstanceToTransitRouter, take note of the billing rules, permission limits, and prerequisites on permission management of transit routers. For more information, see Acquire permissions to connect to a network instance that belongs to another account. -
Before you grant a transit router permissions on a network instance, make sure that the following requirements are met:
The account to which the network instance belongs and the account to which the transit router belongs are of the same type.
The ID of the Alibaba Cloud account to which the transit router belongs is obtained.
The ID of the Cloud Enterprise Network (CEN) instance to which the Enterprise Edition transit router belongs is obtained.
Before you grant a transit router permissions on a VBR, contact your account manager to acquire permissions on the VBR.
Before you grant a transit router permissions on an IPsec-VPN connection, make sure that the IPsec-VPN connection is not associated with a resource.
If the IPsec-VPN connection is attached to a VPN gateway, the IPsec-VPN connection cannot be attached to transit routers within the same account or different accounts.
If the IPsec-VPN connection is attached to a transit router, detach the IPsec-VPN connection from the transit router. For more information, see Delete a network instance connection.
Try it now
Test
RAM authorization
Request parameters
|
Parameter |
Type |
Required |
Description |
Example |
|
CenId |
string |
Yes |
Enter the ID of the Cloud Enterprise Network (CEN) instance to which the transit router belongs. |
cen-44m0p68spvlrqq**** |
|
InstanceId |
string |
Yes |
The ID of the network instance. |
vpc-bp1h8vbrbcgohcju5**** |
|
InstanceType |
string |
Yes |
The type of network instance. Valid values:
|
VPC |
|
RegionId |
string |
No |
The ID of the region where the network instance is deployed. You can call the DescribeChildInstanceRegions operation to query the most recent region list. |
cn-hangzhou |
|
CenOwnerId |
integer |
Yes |
The ID of the Alibaba Cloud account to which the CEN instance belongs. |
1250123456123456 |
|
OrderType |
string |
No |
The entity that pays the fees of the network instance. Valid values:
|
PayByCenOwner |
Response parameters
|
Parameter |
Type |
Description |
Example |
|
object |
The response. |
||
| RequestId |
string |
The ID of the request. |
C6E5992C-A57B-5A6C-9B26-568074DC68BA |
Examples
Success response
JSON format
{
"RequestId": "C6E5992C-A57B-5A6C-9B26-568074DC68BA"
}Error codes
|
HTTP status code |
Error code |
Error message |
Description |
|---|---|---|---|
| 400 | Forbbiden.TransitRouterServiceNotOpen | The user has not open transit router service. | The error message returned because the transit router is disabled. Enable the transit router and try again. |
| 400 | NoPermission.AliyunServiceRoleForCEN | You are not authorized to create the service linked role. Role Name: AliyunServiceRoleForCEN. Service Name: cen.aliyuncs.com. Make sure that the user has been granted the ram:CreateServiceLinkedRole permission. | The error message because you do not have the permissions to create the service-linked role whose role name is AliyunServiceRoleForCEN and service name is cen.aliyuncs.com. You must acquire the ram:CreateServiceLinkedRole permission before you can create the service-linked role. |
| 400 | IllegalParam.CenId | The specified CenId is invalid. | The error message returned because the ID of the CEN instance is invalid. |
| 400 | OperationFailed.TaskConflict | The operation is too frequent, please wait a moment and try again. | The error message returned because this operation is performed at a high frequency. Try again later. |
| 400 | InvalidVbr.NotFound | vbr is not found. | |
| 400 | OperationFailed.GrantCrossAccountExist | Cross-account authorization already exists. | Cross-account authorization already exists. |
| 400 | Forbidden.TransitRouterServiceExpired | The transit router service is out of service. | The transit router service has been suspended due for payment. Please renew the service and try again. |
| 400 | Forbidden.OperateShareResource | You cannot operate shared resources. | You cannot operate shared resources. |
| 400 | InvalidParameter | Invalid parameter. | The error message returned because the parameter is set to an invalid value. |
| 400 | Unauthorized | The AccessKeyId is unauthorized. | The error message returned because you do not have the permissions to perform this operation. |
| 404 | InvalidInstanceId.NotFound | InstanceId is not found. |
See Error Codes for a complete list.
Release notes
See Release Notes for a complete list.