All Products
Search

This Product

    Cloud Firewall:Use Terraform to create a VPC firewall to protect traffic between a VPC and a network instance attached to a Basic Edition transit router

    Document Center

    Cloud Firewall:Use Terraform to create a VPC firewall to protect traffic between a VPC and a network instance attached to a Basic Edition transit router

    Last Updated:Apr 24, 2025

    This topic describes how to create a virtual private cloud (VPC) firewall by using Terraform. The firewall protects access traffic between a VPC and a network instance that is attached to a Basic Edition transit router of a Cloud Enterprise Network (CEN) instance.

    Note

    You can run the sample code in this topic with a few clicks. For more information, visit Terraform Explorer.

    Before you begin

    • An Alibaba Cloud account has all permissions on resources within the account. If an Alibaba Cloud account is leaked, the resources are exposed to major risks. We recommend that you use a Resource Access Management (RAM) user and create an AccessKey pair for the RAM user. For more information, see Create a RAM user and Create an AccessKey pair.

    • The following sample code provides a policy that grants the required permissions on Cloud Firewall to a RAM user. For more information, see Grant permissions to RAM users. 

      {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "yundun-cloudfirewall:*",
                "yundun-ndr:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "vpc:*"                     
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "vpc:CreateVSwitch",       
                "vpc:DescribeVSwitches",    
                "vpc:DeleteVSwitch"        
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cen:*"                      
            ],
            "Resource": "*"
        }
    ]
}

    • Prepare the Terraform environment. You can use one of the following methods to use Terraform:

      Use Terraform in Terraform Explorer: Alibaba Cloud provides Terraform Explorer, an online runtime environment for Terraform. You can use Terraform after you log on to Terraform Explorer without the need to install Terraform. For more information, see Use Terraform in Terraform Explorer. This method is suitable for scenarios in which you want to use and debug Terraform in a fast and convenient manner at no additional cost.

      Use Terraform in Cloud Shell: Terraform is preinstalled in Cloud Shell and identity credentials are configured. You can directly run Terraform commands in Cloud Shell. For more information, see Use Terraform in Cloud Shell. This method is suitable for scenarios in which you want to use and debug Terraform in a fast and convenient manner at low cost.

      Install and configure Terraform on your on-premises machine: This method is suitable for scenarios in which network conditions are poor or a custom development environment is used. For more information, see Install and configure Terraform in the local PC.

      Important

      You must install Terraform 0.12.28 or later. You can run the terraform --version command to query the Terraform version.

    Note

    In this example, fees may be generated for specific resources. Release or unsubscribe from the resources when you no longer require them.

    Resource

    alicloud_cloud_firewall_vpc_firewall_cen: creates a VPC firewall.

    Procedure

    This section describes how to create a VPC firewall.

    1. Create a working directory and a configuration file named main.tf in the directory. main.tf is the main file of Terraform and defines the resources that you want to deploy. 

      variable "region" {
  default = "cn-qingdao"
}
provider "alicloud" {
  region = var.region
}
data "alicloud_account" "current" {
}
# Create VPC 1.
resource "alicloud_vpc" "vpc" {
  vpc_name   = "cen-vpc-01"
  cidr_block = "172.16.0.0/12"
}
# Create VPC 2.
resource "alicloud_vpc" "vpc1" {
  vpc_name   = "cen-vpc-02"
  cidr_block = "172.16.0.0/12"
}
# Create a vSwitch and allocate the CIDR block 172.16.1.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw" {
  vpc_id       = alicloud_vpc.vpc.id
  cidr_block   = "172.16.1.0/24"
  zone_id      = "cn-qingdao-b"
  vswitch_name = "terraform-example-1"
}
# Create a vSwitch and allocate the CIDR block 172.16.0.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw1" {
  vpc_id       = alicloud_vpc.vpc.id
  cidr_block   = "172.16.0.0/24"
  zone_id      = "cn-qingdao-c"
  vswitch_name = "terraform-example-2"
}
# Create a vSwitch and allocate the CIDR block 172.16.4.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw2" {
  vpc_id       = alicloud_vpc.vpc1.id
  cidr_block   = "172.16.4.0/24"
  zone_id      = "cn-qingdao-b"
  vswitch_name = "terraform-example-11"
}
# Create a vSwitch and allocate the CIDR block 172.16.5.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw3" {
  vpc_id       = alicloud_vpc.vpc1.id
  cidr_block   = "172.16.5.0/24"
  zone_id      = "cn-qingdao-c"
  vswitch_name = "terraform-example-22"
}
# The Cloud Enterprise Network (CEN) instance.
resource "alicloud_cen_instance" "example" {
  # The name of the CEN instance.
  cen_instance_name = "tf_example"
  # The description.
  description = "an example for cen"
}
# Create Network Instance Connection 1 to the transit router.
resource "alicloud_cen_instance_attachment" "example" {
  instance_id              = alicloud_cen_instance.example.id
  child_instance_id        = alicloud_vpc.vpc.id
  child_instance_type      = "VPC"
  child_instance_region_id = "cn-qingdao"
}
# Create Network Instance Connection 2 to the transit router.
resource "alicloud_cen_instance_attachment" "example1" {
  instance_id              = alicloud_cen_instance.example.id
  child_instance_id        = alicloud_vpc.vpc1.id
  child_instance_type      = "VPC"
  child_instance_region_id = "cn-qingdao"
}
# Create a CEN instance and network instance connections.
resource "time_sleep" "wait_before_firewall" {
  # Make sure that a CEN instance and the network instance connections are created.
  depends_on = [
    alicloud_cen_instance_attachment.example,
    alicloud_cen_instance_attachment.example1
  ]
  create_duration = "720s" # Specify a latency value based on your business requirements.
}
# The latency.
resource "null_resource" "wait_for_firewall" {
  provisioner "local-exec" {
    command = "echo waiting for firewall to be ready"
  }
  # Make sure that a CEN instance is created.
  depends_on = [time_sleep.wait_before_firewall]
}
# The Basic Edition transit router.
resource "alicloud_cloud_firewall_vpc_firewall_cen" "default" {
  # Make sure that a CEN instance and network instance connections are created and a latency value is specified.
  depends_on = [
    null_resource.wait_for_firewall
  ]
  timeouts {
    create = "30m" # The timeout period of the creation operation.
  }
  # The ID of the CEN instance.
  cen_id = alicloud_cen_instance.example.id
  # The details of the VPC.
  local_vpc {
    # The ID of the VPC for which the VPC firewall is created. 
    network_instance_id = alicloud_cen_instance_attachment.example.child_instance_id
  }
  # The status of the VPC firewall. 
  status = "open"
  # Optional. The ID of the member of the current Alibaba Cloud account.
  member_uid = data.alicloud_account.current.id
  # The region ID of the VPC. 
  vpc_region = var.region
  # The name of the VPC firewall. 
  vpc_firewall_name = "tf-test"
}

    2. Run the following command to initialize Terraform: 

      terraform init

      If the following information is returned, Terraform is initialized: 

      Initializing the backend...

Initializing provider plugins...
- Checking for available provider plugins...
- Downloading plugin for provider "alicloud" (hashicorp/alicloud) 1.203.0...

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

    3. Create an execution plan and preview the changes. 

      terraform plan

    4. Run the following command to create the VPC firewall. 

      terraform apply

      During the execution, enter yes as prompted and press the Enter key. Wait until the command is successfully executed. If the following information appears, the operation is successful: 

      Plan: 12 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

alicloud_vpc.vpc1: Creating...
alicloud_cen_instance.example: Creating...
alicloud_vpc.vpc: Creating...
alicloud_cen_instance.example: Creation complete after 6s [id=cen-igzi112vm9qo95y***]
alicloud_vpc.vpc: Creation complete after 6s [id=vpc-m5e80rjklhxmpvjpc6***]
alicloud_vswitch.vsw: Creating...
alicloud_vpc.vpc1: Creation complete after 6s [id=vpc-m5e31tqo1qwevzb8xy***]
alicloud_vswitch.vsw1: Creating...
alicloud_cen_instance_attachment.example: Creating...
alicloud_vswitch.vsw2: Creating...
alicloud_cen_instance_attachment.example1: Creating...
alicloud_vswitch.vsw3: Creating...
alicloud_vswitch.vsw: Creation complete after 3s [id=vsw-m5e8ziezyqzqv0sc61***]
alicloud_vswitch.vsw2: Creation complete after 3s [id=vsw-m5eefi2ucwn9v6cf9d***]
alicloud_vswitch.vsw1: Creation complete after 7s [id=vsw-m5e60062s0hrie96wd***]
alicloud_vswitch.vsw3: Creation complete after 7s [id=vsw-m5eqoruknlh503wmtf***]
alicloud_cen_instance_attachment.example: Still creating... [10s elapsed]
alicloud_cen_instance_attachment.example1: Still creating... [10s elapsed]
alicloud_cen_instance_attachment.example: Still creating... [20s elapsed]
alicloud_cen_instance_attachment.example1: Still creating... [20s elapsed]
alicloud_cen_instance_attachment.example: Creation complete after 25s [id=cen-igzi112vm9qo95y***:vpc-m5e80rjklhxmpvjpc6***:VPC:cn-qingdao]
alicloud_cen_instance_attachment.example1: Still creating... [30s elapsed]
alicloud_cen_instance_attachment.example1: Creation complete after 35s [id=cen-igzi112vm9qo95y***:vpc-m5e31tqo1qwevzb8xy***:VPC:cn-qingdao]
time_sleep.wait_before_firewall: Creating...
time_sleep.wait_before_firewall: Still creating... [10s elapsed]
time_sleep.wait_before_firewall: Still creating... [20s elapsed]
time_sleep.wait_before_firewall: Still creating... [30s elapsed]
time_sleep.wait_before_firewall: Still creating... [40s elapsed]
time_sleep.wait_before_firewall: Still creating... [50s elapsed]
time_sleep.wait_before_firewall: Still creating... [1m0s elapsed]
time_sleep.wait_before_firewall: Still creating... [1m10s elapsed]
time_sleep.wait_before_firewall: Still creating... [1m20s elapsed]
time_sleep.wait_before_firewall: Creation complete after 1m21s [id=2024-10-31T08:49:08Z]
null_resource.wait_for_firewall: Creating...
null_resource.wait_for_firewall: Provisioning with 'local-exec'...
null_resource.wait_for_firewall (local-exec): Executing: ["/bin/sh" "-c" "echo waiting for firewall to be ready"]
null_resource.wait_for_firewall (local-exec): waiting for firewall to be ready
null_resource.wait_for_firewall: Creation complete after 0s [id=8138826525954951***]
alicloud_cloud_firewall_vpc_firewall_cen.default: Creating...
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [10s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [20s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [30s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [40s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [50s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m0s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m10s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m20s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m30s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m40s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m50s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m0s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m10s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m20s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m30s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m40s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m50s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m0s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m10s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m20s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m30s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m40s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m50s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m0s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m10s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m20s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m30s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m40s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m50s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Creation complete after 4m55s [id=vfw-1bc3b436d49b46ac8***]

Apply complete!  Resources: 12 added, 0 changed, 0 destroyed.

    5. Verify the result.

      Run the terraform show command

      You can run the following command to view the details of the created VPC firewall: 

      terraform show

      image

      Log on to the Cloud Firewall console

      Log on to the Cloud Firewall console, go to the Firewall Settings page, and then click the VPC Firewall tab. Then, search for the VPC firewall by using the firewall ID to view the details of the VPC firewall.

    Resource release

    If you no longer require the preceding resources that are created or managed by using Terraform, run the following command to release the resources. For more information about the terraform destroy command, see Common commands. 

    terraform destroy

    Complete sample code

    Note

    You can run the sample code in this topic with a few clicks. For more information, visit Terraform Explorer.

    Sample code

    variable "region" {
  default = "cn-qingdao"
}
provider "alicloud" {
  region = var.region
}
data "alicloud_account" "current" {
}
# Create VPC 1.
resource "alicloud_vpc" "vpc" {
  vpc_name   = "cen-vpc-01"
  cidr_block = "172.16.0.0/12"
}
# Create VPC 2.
resource "alicloud_vpc" "vpc1" {
  vpc_name   = "cen-vpc-02"
  cidr_block = "172.16.0.0/12"
}
# Create a vSwitch and allocate the CIDR block 172.16.1.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw" {
  vpc_id       = alicloud_vpc.vpc.id
  cidr_block   = "172.16.1.0/24"
  zone_id      = "cn-qingdao-b"
  vswitch_name = "terraform-example-1"
}
# Create a vSwitch and allocate the CIDR block 172.16.0.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw1" {
  vpc_id       = alicloud_vpc.vpc.id
  cidr_block   = "172.16.0.0/24"
  zone_id      = "cn-qingdao-c"
  vswitch_name = "terraform-example-2"
}
# Create a vSwitch and allocate the CIDR block 172.16.4.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw2" {
  vpc_id       = alicloud_vpc.vpc1.id
  cidr_block   = "172.16.4.0/24"
  zone_id      = "cn-qingdao-b"
  vswitch_name = "terraform-example-11"
}
# Create a vSwitch and allocate the CIDR block 172.16.5.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw3" {
  vpc_id       = alicloud_vpc.vpc1.id
  cidr_block   = "172.16.5.0/24"
  zone_id      = "cn-qingdao-c"
  vswitch_name = "terraform-example-22"
}
# The CEN instance.
resource "alicloud_cen_instance" "example" {
  # The name of the CEN instance.
  cen_instance_name = "tf_example"
  # The description.
  description = "an example for cen"
}
# Create Network Instance Connection 1 to the transit router.
resource "alicloud_cen_instance_attachment" "example" {
  instance_id              = alicloud_cen_instance.example.id
  child_instance_id        = alicloud_vpc.vpc.id
  child_instance_type      = "VPC"
  child_instance_region_id = "cn-qingdao"
}
# Create Network Instance Connection 2 to the transit router.
resource "alicloud_cen_instance_attachment" "example1" {
  instance_id              = alicloud_cen_instance.example.id
  child_instance_id        = alicloud_vpc.vpc1.id
  child_instance_type      = "VPC"
  child_instance_region_id = "cn-qingdao"
}
# Create a CEN instance and network instance connections.
resource "time_sleep" "wait_before_firewall" {
  # Make sure that a CEN instance and the network instance connections are created.
  depends_on = [
    alicloud_cen_instance_attachment.example,
    alicloud_cen_instance_attachment.example1
  ]
  create_duration = "720s" # Specify a latency value based on your business requirements.
}
# The latency.
resource "null_resource" "wait_for_firewall" {
  provisioner "local-exec" {
    command = "echo waiting for firewall to be ready"
  }
  # Make sure that a CEN instance is created.
  depends_on = [time_sleep.wait_before_firewall]
}
# The Basic Edition transit router.
resource "alicloud_cloud_firewall_vpc_firewall_cen" "default" {
  # Make sure that a CEN instance and network instance connections are created and a latency value is specified.
  depends_on = [
    null_resource.wait_for_firewall
  ]
  timeouts {
    create = "30m" # The timeout period of the creation operation.
  }
  # The ID of the CEN instance.
  cen_id = alicloud_cen_instance.example.id
  # The details of the VPC.
  local_vpc {
    # The ID of the VPC for which the VPC firewall is created. 
    network_instance_id = alicloud_cen_instance_attachment.example.child_instance_id
  }
  # The status of the VPC firewall. 
  status = "open"
  # Optional. The ID of the member of the current Alibaba Cloud account.
  member_uid = data.alicloud_account.current.id
  # The region ID of the VPC. 
  vpc_region = var.region
  # The name of the VPC firewall. 
  vpc_firewall_name = "tf-test"
}