All Products
Search

This Product

    Cloud Firewall:CreatePrivateDnsEndpoint

    Document Center

    Cloud Firewall:CreatePrivateDnsEndpoint

    Last Updated:Jul 24, 2026

    Creates a private DNS endpoint.

    Operation description

    Creates a policy to allow, deny, or monitor traffic that passes through a NAT firewall.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    yundun-cloudfirewall:CreatePrivateDnsEndpoint

    create

    *PrivateDNS

    acs:yundun-cloudfirewall::{#accountId}:privatedns/*

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    AccessInstanceName

    string

    Yes

    The name of the private instance.

    test
    PrivateDnsType

    string

    Yes

    The type of private DNS. When PrivateDnsType is set to Custom, Port and IpProtocol are required. When PrivateDnsType is set to PrivateZone, the backend automatically sets the port to 53 and uses the default protocol. Valid values:

    • PrivateZone

    • Custom (default)

    Custom
    RegionNo

    string

    Yes

    The region ID of the instance.

    cn-hangzhou
    VpcId

    string

    Yes

    The instance ID of the VPC-connected instance.

    vpc-uf6b5lyul0x******
    PrimaryVSwitchId

    string

    No

    The ID of the primary vSwitch. The zone of PrimaryVSwitchId and StandbyVSwitchId must be a zone that supports private DNS. Otherwise, an error is returned. The region must also be in the supported list.

    vsw-uf6b0dkyryer8******

    StandbyVSwitchId

    string

    No

    The ID of the secondary vSwitch. The zone of PrimaryVSwitchId and StandbyVSwitchId must be a zone that supports private DNS. Otherwise, error code -200534 is returned. The region must also be in the supported list.

    vsw-8vb6jk75wfcwn******

    PrimaryVSwitchIp

    string

    No

    The IP address of the primary vSwitch.

    10.1.1.1

    StandbyVSwitchIp

    string

    No

    The IP address of the secondary vSwitch.

    10.2.2.2
    IpProtocol

    string

    No

    The IP protocol. Valid values:

    • TCP

    • UDP

    UDP
    Port

    integer

    No

    The port number.

    80
    FirewallType

    array

    Yes

    The type of the cloud firewall. Valid values:

    • internet

    • vpc

    • nat

    string

    No

    The type of the cloud firewall. Valid values:

    • internet

    • vpc

    • nat

    [ "internet", "vpc", "nat" ]
    PrimaryDns

    string

    No

    The primary DNS server.

    Note

    When PrivateDnsType is set to Custom, you must specify PrimaryDns and StandbyDns.

    1.1.1.1
    StandbyDns

    string

    No

    The secondary DNS server.

    Note

    When PrivateDnsType is set to Custom, you must specify PrimaryDns and StandbyDns.

    1.1.1.2
    MemberUid

    integer

    No

    The UID of the Alibaba Cloud member accounts.

    258039427902****

    Response elements

    Element

    Type

    Description

    Example

    object

    Schema of Response

    RequestId

    string

    Id of the request

    850A84D6************00090125EEB1
    AccessInstanceId

    string

    The instance ID.

    pd-12345
    TaskId

    string

    The task ID, which uniquely identifies the task.

    132

    Examples

    Success response

    JSON format

    {
  "RequestId": "850A84D6************00090125EEB1",
  "AccessInstanceId": "pd-12345",
  "TaskId": "132"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 ErrorPrivateDnsType private dns type error. Private DNS type error
    400 ErrorPrivateDnsPrivateZoneConfigure private dns parameter error. Private DNS configuration parameter error
    400 ErrorVswitchId vswitch id error. Switch Error
    400 ErrorVswitchIpAddress vswitch ip error. Switch IP Error
    400 ErrorPrivateDnsIpAddress private dns ip address error. Private DNS IP Error
    400 ErrorVswitchNoAvailableIP the vswitch has no available ip. No IP available for the specified switch
    400 ErrorVfwVpcNoAvailable the vpc is cloud firewall vpc, please reselect vpc. The specified VPC is automatically created by Cloud Firewall. Select a new VPC.
    400 ErrorProxyVswitchNoAvailable the vswitch is cloud firewall vswitch, please reselect vswitch. The specified switch is a switch automatically created by the NAT firewall, please reselect the switch
    400 ErrorFirewallTypeDuplicates firewallType duplicates. Private DNS endpoint already exists for selected firewall boundary
    400 ErrorPrivateDnsIpSame the primary and backup DNS IP cannot be the same. The primary and secondary IP addresses of a private DNS cannot be the same.
    400 ErrorPrivateDnsEndpointQuotaExceeded Private DNS endpoint resource exceeds the quota limit. The resources of the private network DNS synchronization node exceed the quota limit.
    400 ErrorPrivateDnsPort private dns port error
    400 ErrorPrivateDnsAzNotSupport private dns is not supported in this availability zone

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.