All Products
Search

This Product

    Cloud Firewall:DescribeVpcFirewallControlPolicy

    Document Center

    Cloud Firewall:DescribeVpcFirewallControlPolicy

    Last Updated:Jul 24, 2026

    Queries all access control policy information for a specified virtual private cloud (VPC) firewall.

    Operation description

    This operation is used to query access control policies of virtual private cloud (VPC) firewalls. Virtual private cloud (VPC) firewalls use different access control policies when protecting traffic between two VPCs connected through Cloud Enterprise Network (CEN) or traffic between two VPCs connected through Express Connect.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    yundun-cloudfirewall:DescribeVpcFirewallControlPolicy

    get

    *VpcFirewallControlPolicy

    acs:cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/{#AclUuid}

    *VpcFirewall

    acs:cloudfirewall::{#accountId}:vpcfirewall/{#VpcFirewallId}

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    Lang

    string

    No

    The language type for requests and responses.

    zh
    VpcFirewallId

    string

    Yes

    The instance ID of the virtual private cloud (VPC) firewall. Valid values:

    vfw-a42bbb7b887148c9****
    CurrentPage

    string

    No

    The page number in a paged query. Settings the current page number for paging.

    1
    PageSize

    string

    No

    The number of access control policies for the virtual private cloud (VPC) firewall on each page in a paged query. Settings the number of policies per page for paging.

    10
    Source

    string

    No

    The source address in the access control policy of the virtual private cloud (VPC) firewall. Fuzzy queries are supported.

    192.0.XX.XX/24
    Destination

    string

    No

    The destination address in the access control policy of the virtual private cloud (VPC) firewall. Fuzzy queries are supported.

    192.0.XX.XX/24
    Description

    string

    No

    The description of the access control policy of the virtual private cloud (VPC) firewall. Fuzzy queries are supported.

    test
    Proto

    string

    No

    The protocol type of the traffic in the access control policy of the virtual private cloud (VPC) firewall. Valid values:

    TCP
    AclAction

    string

    No

    The action (settings) that Cloud Firewall performs on the traffic in the access control policy of the virtual private cloud (VPC) firewall. Valid values:

    accept
    MemberUid

    string

    No

    The UID of a member account of the current Alibaba Cloud account.

    258039427902****
    AclUuid

    string

    No

    The unique identity ID of the access control policy of the virtual private cloud (VPC) firewall.

    4037fbf7-3e39-4634-92a4-d0155247****
    Release

    string

    No

    The enabled status of the access control policy. Valid values:

    true
    RepeatType

    string

    No

    The recurrence type of the policy validity period for the access control policy. Valid values:

    Valid values:

    • Daily :

      every day.

    • Monthly :

      every month.

    • Permanent :

      always.

    • Weekly :

      every week.

    • None :

      a specified one-time period.

    Permanent

    Response elements

    Element

    Type

    Description

    Example

    object

    TotalCount

    string

    The total number of access control policies for the virtual private cloud (VPC) firewall.

    20
    RequestId

    string

    The request ID.

    CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D
    Policys

    array<object>

    The information about the access control policies of the virtual private cloud (VPC) firewall.

    object

    Destination

    string

    The destination address in the access control policy of the virtual private cloud (VPC) firewall. Valid values:

    192.0.XX.XX/24
    Order

    integer

    The priority of the access control policy of the virtual private cloud (VPC) firewall.

    1
    DestPortGroup

    string

    The name of the destination port address book for the traffic in the access control policy of the virtual private cloud (VPC) firewall.

    my_port_group
    SourceType

    string

    The source address type in the access control policy of the virtual private cloud (VPC) firewall. Valid values:

    net
    ApplicationName

    string

    The application type supported by the access control policy of the virtual private cloud (VPC) firewall. Use ApplicationNameList instead. Valid values:

    HTTP
    AclUuid

    string

    The unique identity ID of the access control policy of the virtual private cloud (VPC) firewall.

    4037fbf7-3e39-4634-92a4-d0155247****
    DestPortType

    string

    The destination port type for the traffic in the access control policy of the virtual private cloud (VPC) firewall. Valid values:

    port
    Source

    string

    The source address in the access control policy of the virtual private cloud (VPC) firewall. Valid values:

    192.0.XX.XX/24
    DestinationType

    string

    The destination address type in the access control policy of the virtual private cloud (VPC) firewall. Valid values:

    net
    HitTimes

    integer

    The number of hits for the access control policy of the virtual private cloud (VPC) firewall.

    100
    DestPort

    string

    The destination port of the traffic in the access control policy of the virtual private cloud (VPC) firewall.

    80
    Description

    string

    The description of the access control policy of the virtual private cloud (VPC) firewall.

    test
    AclAction

    string

    The action (settings) that Cloud Firewall performs on the traffic in the access control policy of the virtual private cloud (VPC) firewall. Valid values:

    accept
    ApplicationId

    string

    The ID of the application with traffic settings in the access control policy of the virtual private cloud (VPC) firewall.

    10**
    Proto

    string

    The protocol type of the traffic in the access control policy of the virtual private cloud (VPC) firewall. Valid values:

    TCP
    DestinationGroupCidrs

    array

    The CIDR block information in the destination address book of the access control policy of the virtual private cloud (VPC) firewall.

    string

    The list of CIDR blocks in the destination address book of the access control policy of the virtual private cloud (VPC) firewall.

    ["192.0.XX.XX/24", "192.0.XX.XX/32"]
    DestPortGroupPorts

    array

    The details of the destination port address book in the access control policy of the virtual private cloud (VPC) firewall.

    string

    The list of ports in the destination port address book of the access control policy of the virtual private cloud (VPC) firewall.

    [80,443]
    SourceGroupCidrs

    array

    The details of the source address book in the access control policy of the virtual private cloud (VPC) firewall.

    string

    The list of CIDR blocks in the source address book of the access control policy of the virtual private cloud (VPC) firewall.

    ["192.0.XX.XX/24", "198.51.XX.XX/32"]
    MemberUid

    string

    The UID of a member account of the current Alibaba Cloud account.

    258039427902****
    Release

    string

    The enabled status of the access control policy. The policy is enabled by default after creation. Valid values:

    true
    SourceGroupType

    string

    The type of the source address book in the access control policy. The only valid value is ip, which indicates an IP address book that contains one or more CIDR blocks.

    ip
    DestinationGroupType

    string

    The type of the destination address book in the access control policy. Valid values:

    ip
    HitLastTime

    integer

    The most recent time of hits. The value is a UNIX timestamp in seconds format.

    1579261141
    ModifyTime

    integer

    The time when the policy was modified. The value is a UNIX timestamp in seconds.

    1761062400
    SpreadCnt

    integer

    The number of access control policy specifications consumed, which is the cumulative number of specifications consumed by each policy.

    10000
    CreateTime

    integer

    The time when the policy was created. The value is a UNIX timestamp in seconds.

    1761062400
    ApplicationNameList

    array

    The list of application names.

    string

    The list of application types supported by the access control policy of the virtual private cloud (VPC) firewall. Valid values:

    [ "HTTPS", "SMTPS", "SSL" ]
    RepeatType

    string

    The recurrence type of the policy validity period for the access control policy. Valid values:

    Valid values:

    • Daily :

      every day.

    • Monthly :

      every month.

    • Permanent :

      always.

    • Weekly :

      every week.

    • None :

      a specified one-time period.

    Permanent
    RepeatDays

    array

    The collection of recurrence days for the policy validity period of the access control policy.

    integer

    The recurrence day for the policy validity period of the access control policy.

    1
    RepeatStartTime

    string

    The recurrence start time of the policy validity period. The value is in the HH:mm format using a 24-hour clock, such as 08:00.

    08:00
    RepeatEndTime

    string

    The recurrence end time of the policy validity period. The value is in the HH:mm format using a 24-hour clock, such as 23:00.

    23:30
    StartTime

    integer

    The start time of the policy validity period for the access control policy. The value is a UNIX timestamp in seconds. The time must be on the hour or half hour and must be at least 30 minutes earlier than the end time.

    1694761200
    EndTime

    integer

    The end time of the policy validity period for the access control policy. The value is a UNIX timestamp in seconds. The time must be on the hour or half hour and must be at least 30 minutes later than the start time.

    1694764800
    DomainResolveType

    string

    The domain name resolution method of the access control policy. Valid values:

    FQDN

    Examples

    Success response

    JSON format

    {
  "TotalCount": "20",
  "RequestId": "CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D",
  "Policys": [
    {
      "Destination": "192.0.XX.XX/24",
      "Order": 1,
      "DestPortGroup": "my_port_group",
      "SourceType": "net",
      "ApplicationName": "HTTP",
      "AclUuid": "4037fbf7-3e39-4634-92a4-d0155247****",
      "DestPortType": "port",
      "Source": "192.0.XX.XX/24",
      "DestinationType": "net",
      "HitTimes": 100,
      "DestPort": "80",
      "Description": "test",
      "AclAction": "accept",
      "ApplicationId": "10**",
      "Proto": "TCP",
      "DestinationGroupCidrs": [
        "[\"192.0.XX.XX/24\", \"192.0.XX.XX/32\"]"
      ],
      "DestPortGroupPorts": [
        "[80,443]"
      ],
      "SourceGroupCidrs": [
        "[\"192.0.XX.XX/24\", \"198.51.XX.XX/32\"]"
      ],
      "MemberUid": "258039427902****",
      "Release": "true",
      "SourceGroupType": "ip",
      "DestinationGroupType": "ip",
      "HitLastTime": 1579261141,
      "ModifyTime": 1761062400,
      "SpreadCnt": 10000,
      "CreateTime": 1761062400,
      "ApplicationNameList": [
        "[\n    \"HTTPS\", \n    \"SMTPS\", \n    \"SSL\"\n]"
      ],
      "RepeatType": "Permanent",
      "RepeatDays": [
        1
      ],
      "RepeatStartTime": "08:00",
      "RepeatEndTime": "23:30",
      "StartTime": 1694761200,
      "EndTime": 1694764800,
      "DomainResolveType": "FQDN"
    }
  ]
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 ErrorParametersUid The aliUid parameter is invalid. The aliUid parameter is invalid.
    400 ErrorParametersPageSizeOrNo Either pageSize or pageNo is invalid. Either pageSize or pageNo is invalid.
    400 ErrorDBSelect An error occurred while querying database. An error occurred while querying database.
    400 ErrorUUIDNew The UUID is invalid. The UUID is invalid.
    400 ErrorParametersAppId The appId is invalid. The appId is invalid.
    400 ErrorParameterIpVersion The IP version is invalid. The IP version is invalid.
    400 ErrorParametersDirection The direction is invalid. The direction is invalid.
    400 ErrorParametersSource The source is invalid. The source is invalid.
    400 ErrorDomainResolve A domain resolution error occurred. An error occurred while resolving the domain.
    400 ErrorParametersDestination The Destination parameter is invalid. The Destination parameter is invalid.
    400 ErrorParametersProto The protocol is invalid. The protocol is invalid.
    400 ErrorParametersDestPort The dst_port is invalid. The dst_port is invalid.
    400 ErrorParametersAction The action is invalid. The action is invalid.
    400 ErrorParameters Parameters error. Parameter error.
    400 ErrorMarshalJSON An error occurred while encoding JSON. An error occurred while encoding JSON.
    400 ErrorParametersAclUuid Specified parameter AclUuid is not valid. Specified parameter AclUuid is not valid.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.