DescribeVpcFirewallControlPolicy - Cloud Firewall - Alibaba Cloud Documentation Center

Queries all access control policies for a specified VPC firewall.

Operation description

This operation queries the access control policies for a VPC firewall. A VPC firewall uses access control policies to protect traffic between two VPCs connected by a Cloud Enterprise Network (CEN) instance and between two VPCs connected by an Express Connect circuit.

QPS limits

The queries per second (QPS) limit for this operation is 10 per user. If you exceed this limit, the system throttles your API calls. This may affect your business. You should plan your calls accordingly.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter	Type	Required	Description	Example
Lang	string	No	The language of the request and response. Valid values: zh (default): Chinese en: English	zh
VpcFirewallId	string	Yes	The instance ID of the VPC firewall. Valid values: If the VPC firewall protects traffic between two VPCs connected by a CEN instance, set this parameter to the ID of the CEN instance. If the VPC firewall protects traffic between two VPCs connected by an Express Connect circuit, set this parameter to the instance ID of the VPC firewall. Note You can call the DescribeVpcFirewallAclGroupList operation to query the ID.	vfw-a42bbb7b887148c9****
CurrentPage	string	No	The page number.	1
PageSize	string	No	The number of entries to return on each page. The maximum value is 50.	10
Source	string	No	The source address in the access control policy. Fuzzy query is supported. Note The source can be a CIDR block or the name of an address book.	192.0.XX.XX/24
Destination	string	No	The destination address in the access control policy. Fuzzy query is supported. Note The destination can be a CIDR block, a domain name, or the name of an address book.	192.0.XX.XX/24
Description	string	No	The description of the access control policy. Fuzzy query is supported.	test
Proto	string	No	The protocol type of the traffic in the access control policy. Valid values: TCP UDP ICMP ANY (all protocol types) Note If you do not specify this parameter, policies for all protocol types are queried.	TCP
AclAction	string	No	The action that Cloud Firewall performs on the traffic. Valid values: accept: allow drop: deny log: monitor Note If you do not specify this parameter, policies with all actions are queried.	accept
MemberUid	string	No	The UID of the member account.	258039427902****
AclUuid	string	No	The unique ID of the access control policy.	4037fbf7-3e39-4634-92a4-d0155247****
Release	string	No	The status of the access control policy. Valid values: true: The access control policy is enabled. false: The access control policy is disabled.	true
RepeatType	string	No	The recurrence type for the policy to take effect. Valid values: Permanent (default): The policy is always in effect. None: The policy is in effect for a specific period. Daily: The policy recurs daily. Weekly: The policy recurs weekly. Monthly: The policy recurs monthly. Valid values: Daily : Daily Monthly : Monthly Permanent : Always Weekly : Weekly None : Once	Permanent

Response elements

Element	Type	Description	Example
	object
TotalCount	string	The total number of access control policies.	20
RequestId	string	The ID of the request.	CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D
Policys	array<object>	The details of the access control policies.
	object
Destination	string	The destination address in the access control policy. Valid values: If DestinationType is set to `net`, the value of this parameter is a destination CIDR block. If DestinationType is set to `domain`, the value of this parameter is a destination domain name. If DestinationType is set to `group`, the value of this parameter is the name of a destination address book.	192.0.XX.XX/24
Order	integer	The priority of the access control policy. The priority starts from 1. A smaller value indicates a higher priority.	1
DestPortGroup	string	The name of the destination port address book.	my_port_group
SourceType	string	The source address type in the access control policy. Valid values: net: a source CIDR block group: a source address book	net
ApplicationName	string	The application type that the access control policy supports. We recommend that you use ApplicationNameList. Valid values: HTTP HTTPS MySQL SMTP SMTPS RDP VNC SSH Redis MQTT MongoDB Memcache SSL ANY (all application types)	HTTP
AclUuid	string	The unique ID of the access control policy.	4037fbf7-3e39-4634-92a4-d0155247****
DestPortType	string	The destination port type in the access control policy. Valid values: port: a single port group: a port address book	port
Source	string	The source address in the access control policy. Valid values: If SourceType is set to `net`, the value of this parameter is a source CIDR block. If SourceType is set to `group`, the value of this parameter is the name of a source address book.	192.0.XX.XX/24
DestinationType	string	The destination address type in the access control policy. Valid values: net: a destination CIDR block group: a destination address book domain: a destination domain name	net
HitTimes	integer	The number of hits for the access control policy.	100
DestPort	string	The destination port of the traffic.	80
Description	string	The description of the access control policy.	test
AclAction	string	The action that Cloud Firewall performs on the traffic. Valid values: accept: allow drop: deny log: monitor	accept
ApplicationId	string	The ID of the application.	10**
Proto	string	The protocol type of the traffic. Valid values: TCP UDP ICMP ANY (all protocol types)	TCP
DestinationGroupCidrs	array	The CIDR blocks in the destination address book.
	string	The list of CIDR blocks in the destination address book.	["192.0.XX.XX/24", "192.0.XX.XX/32"]
DestPortGroupPorts	array	The details of the destination port address book.
	string	The list of ports in the destination port address book.	[80,443]
SourceGroupCidrs	array	The details of the source address book.
	string	The list of CIDR blocks in the source address book.	["192.0.XX.XX/24", "198.51.XX.XX/32"]
MemberUid	string	The UID of the member account.	258039427902****
Release	string	The status of the access control policy. The policy is enabled by default after it is created. Valid values: true: The access control policy is enabled. false: The access control policy is disabled.	true
SourceGroupType	string	The type of the source address book. The value is fixed as ip. This indicates an IP address book that contains one or more IP address segments.	ip
DestinationGroupType	string	The type of the destination address book. Valid values: ip: an IP address book that contains one or more IP address segments. domain: a domain name address book that contains one or more domain names.	ip
HitLastTime	integer	The timestamp of the last hit. This value is a UNIX timestamp. Unit: seconds.	1579261141
ModifyTime	integer	The time when the policy was modified. This value is a UNIX timestamp. Unit: seconds.	1761062400
SpreadCnt	integer	The number of policy quota entries that are consumed by the policy. The number of entries is calculated using the following formula: Number of source CIDR blocks × Number of destination addresses (CIDR blocks or domain names) × Number of applications × Number of port ranges.	10,000
CreateTime	integer	The time when the policy was created. This value is a UNIX timestamp. Unit: seconds.	1761062400
ApplicationNameList	array	The list of application names.
	string	An application type that the access control policy supports. Valid values: HTTP HTTPS MySQL SMTP SMTPS RDP VNC SSH Redis MQTT MongoDB Memcache SSL ANY (all application types)	[ "HTTPS", "SMTPS", "SSL" ]
RepeatType	string	The recurrence type for the policy to take effect. Valid values: Permanent (default): The policy is always in effect. None: The policy is in effect for a specific period. Daily: The policy recurs daily. Weekly: The policy recurs weekly. Monthly: The policy recurs monthly. Valid values: Daily : Daily Monthly : Monthly Permanent : Always Weekly : Weekly None : Once	Permanent
RepeatDays	array	The days of a week or of a month on which the policy recurs. If RepeatType is set to `Permanent`, `None`, or `Daily`, this parameter is left empty. Example: [] If RepeatType is set to Weekly, this parameter is not empty. Example: [0, 6] Note If RepeatType is set to Weekly, the values in the array cannot be repeated. If RepeatType is set to `Monthly`, this parameter is not empty. Example: [1, 31] Note If RepeatType is set to Monthly, the values in the array cannot be repeated.
	integer	The day of a week or of a month on which the policy recurs. Note If RepeatType is set to Weekly, the valid values are 0 to 6. A week starts on Sunday. If RepeatType is set to Monthly, the valid values are 1 to 31.	1
RepeatStartTime	string	The start time of the recurrence. For example: 08:00. The time must be on the hour or half hour, and must be at least 30 minutes earlier than the end time. Note If RepeatType is set to Permanent or None, this parameter is left empty. If RepeatType is set to Daily, Weekly, or Monthly, you must specify this parameter.	08:00
RepeatEndTime	string	The end time of the recurrence. For example: 23:30. The time must be on the hour or half hour, and must be at least 30 minutes later than the start time. Note If RepeatType is set to Permanent or None, this parameter is left empty. If RepeatType is set to Daily, Weekly, or Monthly, you must specify this parameter.	23:30
StartTime	integer	The start time of the policy validity period. This is a UNIX timestamp. Unit: seconds. The time must be on the hour or half hour, and must be at least 30 minutes earlier than the end time. Note If RepeatType is set to Permanent, this parameter is left empty. If RepeatType is set to None, Daily, Weekly, or Monthly, you must specify this parameter.	1694761200
EndTime	integer	The end time of the policy validity period. This is a UNIX timestamp. Unit: seconds. The time must be on the hour or half hour, and must be at least 30 minutes later than the start time. Note If RepeatType is set to Permanent, this parameter is left empty. If RepeatType is set to None, Daily, Weekly, or Monthly, you must specify this parameter.	1694764800
DomainResolveType	string	The domain name resolution method of the policy. Valid values: FQDN: FQDN-based DNS: DNS-based dynamic resolution FQDN_AND_DNS: FQDN-based and DNS-based dynamic resolution	FQDN

Examples

Success response

JSON format

{
  "TotalCount": "20",
  "RequestId": "CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D",
  "Policys": [
    {
      "Destination": "192.0.XX.XX/24",
      "Order": 1,
      "DestPortGroup": "my_port_group",
      "SourceType": "net",
      "ApplicationName": "HTTP",
      "AclUuid": "4037fbf7-3e39-4634-92a4-d0155247****",
      "DestPortType": "port",
      "Source": "192.0.XX.XX/24",
      "DestinationType": "net",
      "HitTimes": 100,
      "DestPort": "80",
      "Description": "test",
      "AclAction": "accept",
      "ApplicationId": "10**",
      "Proto": "TCP",
      "DestinationGroupCidrs": [
        "[\"192.0.XX.XX/24\", \"192.0.XX.XX/32\"]"
      ],
      "DestPortGroupPorts": [
        "[80,443]"
      ],
      "SourceGroupCidrs": [
        "[\"192.0.XX.XX/24\", \"198.51.XX.XX/32\"]"
      ],
      "MemberUid": "258039427902****",
      "Release": "true",
      "SourceGroupType": "ip",
      "DestinationGroupType": "ip",
      "HitLastTime": 1579261141,
      "ModifyTime": 1761062400,
      "SpreadCnt": 0,
      "CreateTime": 1761062400,
      "ApplicationNameList": [
        "[\n    \"HTTPS\", \n    \"SMTPS\", \n    \"SSL\"\n]"
      ],
      "RepeatType": "Permanent",
      "RepeatDays": [
        1
      ],
      "RepeatStartTime": "08:00",
      "RepeatEndTime": "23:30",
      "StartTime": 1694761200,
      "EndTime": 1694764800,
      "DomainResolveType": "FQDN"
    }
  ]
}

Error codes

HTTP status code	Error code	Error message	Description
400	ErrorParametersUid	The aliUid parameter is invalid.	The aliUid parameter is invalid.
400	ErrorParametersPageSizeOrNo	Either pageSize or pageNo is invalid.	Either pageSize or pageNo is invalid.
400	ErrorDBSelect	An error occurred while querying database.	An error occurred while querying database.
400	ErrorUUIDNew	The UUID is invalid.	The UUID is invalid.
400	ErrorParametersAppId	The appId is invalid.	The appId is invalid.
400	ErrorParameterIpVersion	The IP version is invalid.	The IP version is invalid.
400	ErrorParametersDirection	The direction is invalid.	The direction is invalid.
400	ErrorParametersSource	The source is invalid.	The source is invalid.
400	ErrorDomainResolve	A domain resolution error occurred.	An error occurred while resolving the domain.
400	ErrorParametersDestination	The Destination parameter is invalid.	The Destination parameter is invalid.
400	ErrorParametersProto	The protocol is invalid.	The protocol is invalid.
400	ErrorParametersDestPort	The dst_port is invalid.	The dst_port is invalid.
400	ErrorParametersAction	The action is invalid.	The action is invalid.
400	ErrorParameters	Parameters error.	Parameter error.
400	ErrorMarshalJSON	An error occurred while encoding JSON.	An error occurred while encoding JSON.
400	ErrorParametersAclUuid	Specified parameter AclUuid is not valid.	Specified parameter AclUuid is not valid.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.