Use CreateVpcFirewallControlPolicy to add an access control policy for a VPC firewall - Cloud Firewall - Alibaba Cloud - Cloud Firewall

Adds an access control policy to a specified VPC firewall policy group.

Operation description

This operation is used to add an access control policy to a specified virtual private cloud (VPC) firewall policy group. Different access control policies are used when a VPC firewall protects traffic between two VPCs connected through a Cloud Enterprise Network (CEN) instance or traffic between two VPCs connected through an Express Connect circuit.

QPS limit

The single-user QPS limit for this operation is 10 calls per second. If the number of calls exceeds the limit, throttling is triggered, which may affect your business. Invoke this operation as appropriate.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-cloudfirewall:CreateVpcFirewallControlPolicy

create

*VpcFirewallControlPolicy

acs:cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/*

None

Request parameters

Parameter	Type	Required	Description	Example
Lang	string	No	The language of the request and response. Valid values: zh (default): Chinese en: English	zh
AclAction	string	Yes	The action that Cloud Firewall performs on the traffic in the virtual private cloud (VPC) firewall access control policy. Valid values: accept: allows the traffic. drop: denies the traffic. log: monitors the traffic.	accept
ApplicationName `deprecated`	string	No	The application type supported by the virtual private cloud (VPC) firewall access control policy. Valid values: FTP HTTP HTTPS MySQL SMTP SMTPS RDP VNC SSH Redis MQTT MongoDB Memcache SSL ANY: all application types	HTTP
Description	string	Yes	The description of the virtual private cloud (VPC) firewall access control policy.	test
DestPort	string	No	The destination port in the virtual private cloud (VPC) firewall access control policy for traffic access. Note When DestPortType is set to `port`, configure this parameter. When Proto is set to TCP/UDP/ICMP, either DestPort (with DestPortType=port) or DestPortGroup (with DestPortType=group) is conditionally required. Otherwise, ErrorParametersDestPort(400) is returned.	80
Destination	string	Yes	The destination address in the virtual private cloud (VPC) firewall access control policy for traffic access. Valid values: If DestinationType is set to `net`, the value of Destination is a destination CIDR block. If DestinationType is set to `group`, the value of Destination is a destination address book name. If DestinationType is set to `domain`, the value of Destination is a destination domain name.	10.2.XX.XX/24
DestinationType	string	Yes	The type of the destination address in the virtual private cloud (VPC) firewall access control policy. Valid values: net: destination CIDR block group: destination address book domain: destination domain name	net
VpcFirewallId	string	Yes	The ID of the virtual private cloud (VPC) firewall access control policy group. If the VPC firewall protects traffic between two VPCs connected through a CEN instance, the value of this parameter is the CEN instance ID. If the VPC firewall protects traffic between two VPCs connected through an Express Connect circuit, the value of this parameter is the VPC firewall instance ID. Note You can call the DescribeVpcFirewallAclGroupList operation to query the ID.	vfw-a42bbb7b887148c9****
Proto	string	Yes	The security protocol type for traffic access in the virtual private cloud (VPC) firewall access control policy. Valid values: ANY: any protocol type TCP UDP ICMP	TCP
Source	string	Yes	The source address in the virtual private cloud (VPC) firewall access control policy. If SourceType is set to `net`, the value of Source is a source CIDR block. If SourceType is set to `group`, the value of Source is a source address book name.	10.2.XX.XX/24
SourceType	string	Yes	The type of the source address in the virtual private cloud (VPC) firewall access control policy. Valid values: net: source CIDR block group: source address book	net
NewOrder	string	Yes	The priority of the virtual private cloud (VPC) firewall access control policy. The priority value starts from 1 and increases by increment. A smaller value indicates a higher priority.	1
DestPortType	string	No	The type of the destination port for traffic access in the virtual private cloud (VPC) firewall access control policy. Valid values: port: port group: port address book	port
DestPortGroup	string	No	The name of the destination port address book for traffic access in the virtual private cloud (VPC) firewall access control policy. Note When DestPortType is set to `group`, configure this parameter.	my_port_group
MemberUid	string	No	The UID of a member account of the current Alibaba Cloud account.	258039427902****
Release	string	No	Specifies whether to enable the access control policy. The policy is enabled by default after it is created. Valid values: true: enables the access control policy. false: does not enable the access control policy.	true
ApplicationNameList	array	No	The application types supported by the access control policy.
	string	No	The application type supported by the access control policy. Valid values: FTP HTTP HTTPS Memcache MongoDB MQTT MySQL RDP Redis SMTP SMTPS SSH SSL_No_Cert SSL VNC ANY: all application types Note The supported application types depend on the value of the protocol type (Proto). When Proto is set to TCP, ApplicationNameList supports all the preceding application types. Use the format `["HTTP","HTTPS",……]`. When Proto is set to UDP, ICMP, or ANY, ApplicationNameList supports only ANY. You must specify either ApplicationNameList or ApplicationName. They cannot both be empty. If both ApplicationNameList and ApplicationName are specified, ApplicationNameList takes precedence.	[ "ANY" ]
RepeatType	string	No	The recurrence type of the policy validity period for the access control policy. Valid values: Permanent (default): always None: one-time Daily: daily Weekly: weekly Monthly: monthly Valid values: Daily : daily. Monthly : monthly. Permanent : always. Weekly : weekly. None : one-time.	Permanent
RepeatDays	array	No	The days of a week or of a month on which the access control policy takes effect. When RepeatType is set to `Permanent`, `None`, or `Daily`, RepeatDays is an empty collection. Example: [] When RepeatType is set to Weekly, RepeatDays cannot be empty. Example: [0, 6] Note When RepeatType is set to Weekly, RepeatDays does not allow duplicate values. When RepeatType is set to `Monthly`, RepeatDays cannot be empty. Example: [1, 31] Note When RepeatType is set to Monthly, RepeatDays does not allow duplicate values.
	integer	No	The recurrence day of the policy validity period for the access control policy. Note When RepeatType is set to Weekly, the valid values are 0 to 6. A week starts on Sunday. When RepeatType is set to Monthly, the valid values are 1 to 31.	1
RepeatStartTime	string	No	The recurrence start time of the policy validity period for the access control policy. Example: 08:00. The value must be on the hour or on the half hour and must be at least 30 minutes earlier than the recurrence end time. Note When RepeatType is set to Permanent or None, RepeatStartTime is empty. When RepeatType is set to Daily, Weekly, or Monthly, RepeatStartTime must have a value. Format: HH:MM (24-hour clock). Example: 08:00.	08:00
RepeatEndTime	string	No	The recurrence end time of the policy validity period for the access control policy. Example: 23:30. The value must be on the hour or on the half hour and must be at least 30 minutes later than the recurrence start time. Note When RepeatType is set to Permanent or None, RepeatEndTime is empty. When RepeatType is set to Daily, Weekly, or Monthly, RepeatEndTime must have a value. Format: HH:MM (24-hour clock). Example: 08:00.	23:30
StartTime	integer	No	The start time of the policy validity period for the access control policy. The value is a UNIX timestamp in seconds. The value must be on the hour or on the half hour and must be at least 30 minutes earlier than the end time. Note When RepeatType is set to Permanent, StartTime is empty. When RepeatType is set to None, Daily, Weekly, or Monthly, StartTime must have a value.	1694761200
EndTime	integer	No	The end time of the policy validity period for the access control policy. The value is a UNIX timestamp in seconds. The value must be on the hour or on the half hour and must be at least 30 minutes later than the start time. Note When RepeatType is set to Permanent, EndTime is empty. When RepeatType is set to None, Daily, Weekly, or Monthly, EndTime must have a value.	1694764800
DomainResolveType	string	No	The domain name resolution method of the access control policy. Valid values: FQDN: FQDN-based DNS: DNS-based dynamic resolution FQDN_AND_DNS: FQDN and DNS-based dynamic resolution	FQDN

Response elements

Element	Type	Description	Example
	object
AclUuid	string	The unique ID of the access control policy.	00281255-d220-4db1-8f4f-c4df221ad84c
RequestId	string	The request ID.	CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D

Examples

Success response

JSON format

{
  "AclUuid": "00281255-d220-4db1-8f4f-c4df221ad84c",
  "RequestId": "CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D"
}

Error codes

HTTP status code	Error code	Error message	Description
400	ErrorParametersUid	The aliUid parameter is invalid.	The aliUid parameter is invalid.
400	ErrorUUIDNew	The UUID is invalid.	The UUID is invalid.
400	ErrorParametersSource	The source is invalid.	The source is invalid.
400	ErrorParametersDestination	The Destination parameter is invalid.	The Destination parameter is invalid.
400	ErrorParametersProto	The protocol is invalid.	The protocol is invalid.
400	ErrorParametersDestPort	The dst_port is invalid.	The dst_port is invalid.
400	ErrorParametersAction	The action is invalid.	The action is invalid.
400	ErrorDBSelect	An error occurred while querying database.	An error occurred while querying database.
400	ErrorParameters	A parameter error occurred.	A parameter error occurred.
400	ErrorAddressCountExceed	The maximum number of addresses is exceeded.	The maximum number of address is exceeded.
400	ErrorParametersNewOrder	The newOrder is invalid.	The newOrder is invalid.
400	ErrorDBInsert	An error occurred while performing an insert operation in the database.	An error occurred while performing an insert operation in the database.
400	ErrorDBDelete	An error occurred while deleting the database.	An error occurred while deleting the database.
400	ErrorRecordLog	An error occurred while updating the operation log.	An error occurred while updating the operation log.
400	ErrorParameterIpVersion	The IP version is invalid.	The IP version is invalid.
400	ErrorParametersDirection	The direction is invalid.	The direction is invalid.
400	ErrorDomainResolve	An error occurred while resolving the domain.	An error occurred while resolving the domain.
400	ErrorAclExtendedCountExceed	ACL or extended ACL rules are not matched.	The quota for access control policies or extra access control policies is exhausted.
400	ErrorAclDomainAnyCountExceed	The number of resolved domain names cannot exceed 200. ACL configuration can be continued for HTTP, HTTPS, SMTP, SMTPS, and SSL applications.	The domain name is resolved to more than 200 IP addresses. We recommend that you set Application in your access control policy to HTTPS, HTTPS, SMTP, SMTPS, or SSL.
400	ErrorMarshalJSON	An error occurred. Try again later.	An error occurred. Try again later.
400	ErrorParametersFtpNotSupport	domain destination not support ftp.	FTP application is not supported when the policy destination is a domain name
400	ErrorParametersApplicationName	Specified parameter ApplicationName is not valid.	Specified parameter ApplicationName is not valid.
400	ErrorParametersApplicationNameList	Specified parameter ApplicationNameList is not valid.	Specified parameter ApplicationNameList is not valid.
400	ErrorAddressGroupNotExist	The address group does not exist.	The address group does not exist.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.