All Products
Search

This Product

    Cloud Firewall:ModifyVpcFirewallControlPolicy

    Document Center

    Cloud Firewall:ModifyVpcFirewallControlPolicy

    Last Updated:Dec 15, 2025

    Modifies an access control policy in a policy group for a VPC firewall.

    Operation description

    This operation modifies an access control policy in a policy group for a VPC firewall. VPC firewalls that protect Cloud Enterprise Network (CEN) instances and Express Connect circuits use different access control policies.

    QPS limits

    The queries per second (QPS) limit for each user is 10 calls per second. If you exceed this limit, your API calls are throttled. This may affect your business. Plan your calls accordingly.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    No authorization for this operation. If you encounter issues with this operation, contact technical support.

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    Lang

    string

    No

    The language of the response.

    Valid values:

    • zh: (Default) Chinese

    • en: English

    zh
    AclAction

    string

    No

    The action that Cloud Firewall performs on the traffic that matches the access control policy.

    Valid values:

    • accept: Allow

    • drop: Deny

    • log: Monitor

    accept
    ApplicationName deprecated

    string

    No

    The application type in the access control policy.

    Valid values:

    • ANY (all application types)

    • FTP

    • HTTP

    • HTTPS

    • MySQL

    • SMTP

    • SMTPS

    • RDP

    • VNC

    • SSH

    • Redis

    • MQTT

    • MongoDB

    • Memcache

    • SSL

    HTTP
    Description

    string

    No

    The description of the access control policy.

    test
    DestPort

    string

    No

    The destination port for the traffic in the access control policy.

    80
    Destination

    string

    No

    The destination address in the access control policy.

    • If DestinationType is net, set this parameter to a destination CIDR block. Example: 10.2.3.0/24

      Example: 10.2.3.0/24

    • If DestinationType is group, set this parameter to the name of a destination address book. Example: db_group

      For example: db_group

    • If DestinationType is domain, set this parameter to a destination domain name. Example: *.aliyuncs.com

      For example: *.aliyuncs.com

    10.2.X.X/XX
    DestinationType

    string

    No

    The type of the destination address in the access control policy.

    Valid values:

    • net: destination CIDR block

    • group: destination address book

    • domain: destination domain name

    net
    VpcFirewallId

    string

    Yes

    The ID of the VPC firewall instance. Call DescribeVpcFirewallAclGroupList to get the ID.

    • If the VPC firewall protects a Cloud Enterprise Network (CEN) instance, set this parameter to the ID of the CEN instance. Example: cen-ervw0g12b5jbw****

      For example, cen-ervw0g12b5jbw****

    • If the VPC firewall protects an Express Connect circuit, set this parameter to the ID of the VPC firewall instance. Example: vfw-a42bbb7b887148c9****

      For example, vfw-a42bbb7b887148c9****

    vfw-a42bbb7b887148c9****
    Proto

    string

    No

    The protocol type of the traffic in the access control policy.

    Valid values:

    • ANY (all protocol types)

    • TCP

    • UDP

    • ICMP

    TCP
    Source

    string

    No

    The source address in the access control policy.

    Valid values:

    • If SourceType is net, set this parameter to a source CIDR block. Example: 10.2.4.0/24

      Example: 10.2.4.0/24

    • If SourceType is group, set this parameter to the name of a source address book. Example: db_group

      For example: db_group

    10.2.X.X/XX
    AclUuid

    string

    Yes

    The unique ID of the access control policy.

    To modify the policy, you must provide this ID. Call DescribeVpcFirewallControlPolicy to get the ID.

    00281255-d220-4db1-8f4f-c4df221a****
    SourceType

    string

    No

    The type of the source address in the access control policy.

    Valid values:

    • net: source CIDR block

    • group: source address book

    net
    DestPortType

    string

    No

    The type of the destination port for the traffic in the access control policy.

    • port: port

    • group: port address book

    port
    DestPortGroup

    string

    No

    The name of the destination port address book for the traffic in the access control policy.

    my_port_group
    Release

    string

    No

    The status of the access control policy. The policy is enabled by default after it is created. Valid values:

    • true: Enable the access control policy.

    • false: Disable the access control policy.

    true
    ApplicationNameList

    array

    No

    The list of application names.

    string

    No

    An application name.

    ["ANY"]
    RepeatType

    string

    No

    The recurrence type for the Policy Validity Period. Valid values:

    • Permanent (default): always

    • None: a specific time

    • Daily: daily

    • Weekly: weekly

    • Monthly: monthly

    Valid values:

    • Daily :

      Daily

    • Monthly :

      Monthly

    • Permanent :

      Always

    • Weekly :

      Weekly

    • None :

      A specific time

    Permanent
    RepeatDays

    array

    No

    The days of the week or month on which the policy is recurrently active.

    • If RepeatType is Permanent, None, or Daily, leave this parameter empty. Example: []

    • If RepeatType is Weekly, this parameter is required. Example: [0, 6]

    Note

    If RepeatType is set to Weekly, the values in the array cannot be repeated.

    • If RepeatType is Monthly, this parameter is required. Example: [1, 31]

    Note

    If RepeatType is set to Monthly, the values in the array cannot be repeated.

    integer

    No

    The day of the week or month on which the policy is recurrently active.

    Note

    If RepeatType is set to Weekly, the value can be from 0 to 6. A week starts on Sunday. If RepeatType is set to Monthly, the value can be from 1 to 31.

    1
    RepeatStartTime

    string

    No

    The start time of the recurrent period. For example: 08:00. The time must be on the hour or half-hour, and at least 30 minutes earlier than the end time.

    Note

    If RepeatType is Permanent or None, this parameter is empty. If RepeatType is Daily, Weekly, or Monthly, this parameter is required.

    08:00
    RepeatEndTime

    string

    No

    The end time of the recurrent period. For example: 23:30. The time must be on the hour or half-hour, and at least 30 minutes later than the start time.

    Note

    If RepeatType is Permanent or None, this parameter is empty. If RepeatType is Daily, Weekly, or Monthly, this parameter is required.

    23:30
    StartTime

    integer

    No

    The start time of the policy validity period. This value is a UNIX timestamp. The time must be on the hour or half-hour, and at least 30 minutes earlier than the end time.

    Note

    If RepeatType is Permanent, this parameter is empty. If RepeatType is None, Daily, Weekly, or Monthly, this parameter is required.

    1694761200
    EndTime

    integer

    No

    The end time of the policy validity period. This value is a UNIX timestamp. The time must be on the hour or half-hour, and at least 30 minutes later than the start time.

    Note

    If RepeatType is Permanent, this parameter is empty. If RepeatType is None, Daily, Weekly, or Monthly, this parameter is required.

    1694764800
    DomainResolveType

    string

    No

    The domain name resolution method of the access control policy. Valid values:

    • FQDN: FQDN-based

    • DNS: DNS-based dynamic resolution

    • FQDN_AND_DNS: FQDN-based and DNS-based dynamic resolution

    FQDN

    Response elements

    Element

    Type

    Description

    Example

    object

    RequestId

    string

    The ID of the request.

    CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D

    Examples

    Success response

    JSON format

    {
  "RequestId": "CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 ErrorParametersUid The aliUid parameter is invalid. The aliUid parameter is invalid.
    400 ErrorDBSelect An error occurred while querying database. An error occurred while querying database.
    400 ErrorParametersSource The source is invalid. The source is invalid.
    400 ErrorParametersProto The protocol is invalid. The protocol is invalid.
    400 ErrorParametersDestination The Destination parameter is invalid. The Destination parameter is invalid.
    400 ErrorParametersDestPort The dst_port is invalid. The dst_port is invalid.
    400 ErrorParametersAction The action is invalid. The action is invalid.
    400 ErrorAddressCountExceed The maximum number of addresses is exceeded. The maximum number of address is exceeded.
    400 ErrorAclNotExist The ACL does not exist. The ACL does not exist.
    400 ErrorRecordLog An error occurred while updating the operation log. An error occurred while updating the operation log.
    400 ErrorAclEffectiveTimeNonPermanent ACL rule is not allowed to update status when effective is not permanent. ACL rule is not allowed to update status when effective is not permanent.
    400 ErrorUUIDNew The UUID is invalid. The UUID is invalid.
    400 ErrorParameterIpVersion The IP version is invalid. The IP version is invalid.
    400 ErrorParametersDirection The direction is invalid. The direction is invalid.
    400 ErrorDomainResolve A domain resolution error occurred. An error occurred while resolving the domain.
    400 ErrorParameters Parameters error. Parameter error.
    400 ErrorAclExtendedCountExceed ACL or extended ACL rules are not matched. The quota for access control policies or extra access control policies is exhausted.
    400 ErrorAclDomainAnyCountExceed The number of resolved domain names cannot exceed 200. ACL configuration can be continued for HTTP, HTTPS, SMTP, SMTPS, and SSL applications. The domain name is resolved to more than 200 IP addresses. We recommend that you set Application in your access control policy to HTTPS, HTTPS, SMTP, SMTPS, or SSL.
    400 ErrorDBUpdate internal error: sql updat. An error occurred while updating the database.
    400 ErrorDBInsert An error occurred while performing an insert operation in the database. An error occurred while performing an insert operation in the database.
    400 ErrorParametersFtpNotSupport domain destination not support ftp. FTP application is not supported when the policy destination is a domain name
    400 ErrorParametersApplicationName Specified parameter ApplicationName is not valid. Specified parameter ApplicationName is not valid.
    400 ErrorParametersApplicationNameList Specified parameter ApplicationNameList is not valid. Specified parameter ApplicationNameList is not valid.
    400 ErrorParametersAclUuid Specified parameter AclUuid is not valid. Specified parameter AclUuid is not valid.
    400 ErrorAddressGroupNotExist The address group does not exist. The address group does not exist.
    400 ErrorParametersVpcFirewallId Specified parameter VpcFirewallId is not valid. Specified parameter VpcFirewallId is not valid.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.