Use CreateVpcFirewallControlPolicy to add an access control policy for a VPC firewall - Cloud Firewall - Alibaba Cloud - Cloud Firewall

Adds an access control policy to a specified VPC firewall policy group.

Operation description

This operation is used to add an access control policy to a specified virtual private cloud (VPC) firewall policy group. Different access control policies are used when a VPC firewall protects traffic between two VPCs connected through Cloud Enterprise Network (CEN) or traffic between two VPCs connected through Express Connect.

QPS limit

The single-user QPS limit for this operation is 10 calls per second. If the number of calls exceeds the limit, throttling is triggered, which may affect your business. Invoke this operation properly.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-cloudfirewall:CreateVpcFirewallControlPolicy

create

*VpcFirewallControlPolicy

acs:cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/*

None

Request parameters

Parameter	Type	Required	Description	Example
Lang	string	No	The language of the request and response. Valid values: zh (default): Chinese en: English.	zh
AclAction	string	Yes	The action that Cloud Firewall performs on the traffic in the virtual private cloud (VPC) firewall access control policy. Valid values: accept: allows the traffic. drop: denies the traffic. log: monitors the traffic.	accept
ApplicationName `deprecated`	string	No	The application type supported by the virtual private cloud (VPC) firewall access control policy. Valid values: FTP HTTP HTTPS MySQL SMTP SMTPS RDP VNC SSH Redis MQTT MongoDB Memcache SSL ANY: all application types.	HTTP
Description	string	Yes	The description of the virtual private cloud (VPC) firewall access control policy.	test
DestPort	string	No	The destination port of traffic in the virtual private cloud (VPC) firewall access control policy. Note Set this parameter when DestPortType is set to `port`.	80
Destination	string	Yes	The destination address of traffic in the virtual private cloud (VPC) firewall access control policy. Valid values: If DestinationType is set to `net`, the value of Destination is a destination CIDR block. If DestinationType is set to `group`, the value of Destination is a destination address book name. If DestinationType is set to `domain`, the value of Destination is a destination domain name.	10.2.XX.XX/24
DestinationType	string	Yes	The type of the destination address in the virtual private cloud (VPC) firewall access control policy. Valid values: net: destination CIDR block group: destination address book domain: destination domain name.	net
VpcFirewallId	string	Yes	The ID of the virtual private cloud (VPC) firewall access control policy group. If the VPC firewall protects traffic between two VPCs connected through CEN, the value of this parameter is the CEN instance ID. If the VPC firewall protects traffic between two VPCs connected through Express Connect, the value of this parameter is the VPC firewall instance ID. Note You can invoke the DescribeVpcFirewallAclGroupList operation to obtain the ID.	vfw-a42bbb7b887148c9****
Proto	string	Yes	The security protocol type of traffic in the virtual private cloud (VPC) firewall access control policy. Valid values: ANY: any protocol type. Set this value if the protocol type is uncertain. TCP UDP ICMP.	TCP
Source	string	Yes	The source address in the virtual private cloud (VPC) firewall access control policy. If SourceType is set to `net`, the value of Source is a source CIDR block. If SourceType is set to `group`, the value of Source is a source address book name.	10.2.XX.XX/24
SourceType	string	Yes	The type of the source address in the virtual private cloud (VPC) firewall access control policy. Valid values: net: source CIDR block group: source address book.	net
NewOrder	string	Yes	The priority of the virtual private cloud (VPC) firewall access control policy. The priority value starts from 1 and increases by increment. A smaller value indicates a higher priority.	1
DestPortType	string	No	The type of the destination port of traffic in the virtual private cloud (VPC) firewall access control policy. Valid values: port: port group: port address book.	port
DestPortGroup	string	No	The name of the destination port address book of traffic in the virtual private cloud (VPC) firewall access control policy. Note Set this parameter when DestPortType is set to `group`.	my_port_group
MemberUid	string	No	The UID of a member account of the current Alibaba Cloud account.	258039427902****
Release	string	No	Specifies whether to enable the access control policy. The policy is enabled by default after it is created. Valid values: true: enables the access control policy. false: does not enable the access control policy.	true
ApplicationNameList	array	No	The application types supported by the access control policy.
	string	No	The application type supported by the access control policy. Valid values: FTP HTTP HTTPS Memcache MongoDB MQTT MySQL RDP Redis SMTP SMTPS SSH SSL_No_Cert SSL VNC ANY: all application types Note The supported application types depend on the value of the protocol type (Proto). If Proto is set to TCP, ApplicationNameList supports all the preceding application types and is expressed in the format of `["HTTP","HTTPS",……]`. If Proto is set to UDP, ICMP, or ANY, ApplicationNameList supports only ANY. You must specify either ApplicationNameList or ApplicationName. Both parameters cannot be empty at the same time. If both ApplicationNameList and ApplicationName are specified, ApplicationNameList takes precedence.	[ "ANY" ]
RepeatType	string	No	The recurrence type of the policy validity period for the access control policy. Valid values: Permanent (default): The policy is always valid. None: The policy is valid for a specified single time period. Daily: The policy is valid on a daily basis. Weekly: The policy is valid on a weekly basis. Monthly: The policy is valid on a monthly basis. Valid values: Daily : daily. Monthly : monthly. Permanent : always. Weekly : weekly. None : specified single time period.	Permanent
RepeatDays	array	No	The days of the recurrence for the policy validity period of the access control policy. If RepeatType is set to `Permanent`, `None`, or `Daily`, RepeatDays is an empty collection. Example: [] If RepeatType is set to Weekly, RepeatDays cannot be empty. Example: [0, 6] Note If RepeatType is set to Weekly, the values in RepeatDays cannot be repeated. If RepeatType is set to `Monthly`, RepeatDays cannot be empty. Example: [1, 31] Note If RepeatType is set to Monthly, the values in RepeatDays cannot be repeated.
	integer	No	The recurrence day of the policy validity period for the access control policy. Note If RepeatType is set to Weekly, the valid values are 0 to 6. The week starts on Sunday. If RepeatType is set to Monthly, the valid values are 1 to 31.	1
RepeatStartTime	string	No	The recurrence start time of the policy validity period for the access control policy. Example: 08:00. The value must be on the hour or on the half hour and must be at least 30 minutes earlier than the recurrence end time. Note If RepeatType is set to Permanent or None, RepeatStartTime is empty. If RepeatType is set to Daily, Weekly, or Monthly, RepeatStartTime must be specified. The format is HH:MM (24-hour clock), such as 08:00.	08:00
RepeatEndTime	string	No	The recurrence end time of the policy validity period for the access control policy. Example: 23:30. The value must be on the hour or on the half hour and must be at least 30 minutes later than the recurrence start time. Note If RepeatType is set to Permanent or None, RepeatEndTime is empty. If RepeatType is set to Daily, Weekly, or Monthly, RepeatEndTime must be specified. The format is HH:MM (24-hour clock), such as 08:00.	23:30
StartTime	integer	No	The start time of the policy validity period for the access control policy. The value is a UNIX timestamp in seconds. The value must be on the hour or on the half hour and must be at least 30 minutes earlier than the end time. Note If RepeatType is set to Permanent, StartTime is empty. If RepeatType is set to None, Daily, Weekly, or Monthly, StartTime must be specified.	1694761200
EndTime	integer	No	The end time of the policy validity period for the access control policy. The value is a UNIX timestamp in seconds. The value must be on the hour or on the half hour and must be at least 30 minutes later than the start time. Note If RepeatType is set to Permanent, EndTime is empty. If RepeatType is set to None, Daily, Weekly, or Monthly, EndTime must be specified.	1694764800
DomainResolveType	string	No	The domain name resolution method of the access control policy. Valid values: FQDN: FQDN-based resolution DNS: DNS-based dynamic resolution FQDN_AND_DNS: FQDN-based and DNS-based dynamic resolution.	FQDN

Response elements

Element	Type	Description	Example
	object
AclUuid	string	The unique ID of the access control policy.	00281255-d220-4db1-8f4f-c4df221ad84c
RequestId	string	The request ID.	CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D

Examples

Success response

JSON format

{
  "AclUuid": "00281255-d220-4db1-8f4f-c4df221ad84c",
  "RequestId": "CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D"
}

Error codes

HTTP status code	Error code	Error message	Description
400	ErrorParametersUid	The aliUid parameter is invalid.	The aliUid parameter is invalid.
400	ErrorUUIDNew	The UUID is invalid.	The UUID is invalid.
400	ErrorParametersSource	The source is invalid.	The source is invalid.
400	ErrorParametersDestination	The Destination parameter is invalid.	The Destination parameter is invalid.
400	ErrorParametersProto	The protocol is invalid.	The protocol is invalid.
400	ErrorParametersDestPort	The dst_port is invalid.	The dst_port is invalid.
400	ErrorParametersAction	The action is invalid.	The action is invalid.
400	ErrorDBSelect	An error occurred while querying database.	An error occurred while querying database.
400	ErrorParameters	A parameter error occurred.	A parameter error occurred.
400	ErrorAddressCountExceed	The maximum number of addresses is exceeded.	The maximum number of address is exceeded.
400	ErrorParametersNewOrder	The newOrder is invalid.	The newOrder is invalid.
400	ErrorDBInsert	An error occurred while performing an insert operation in the database.	An error occurred while performing an insert operation in the database.
400	ErrorDBDelete	An error occurred while deleting the database.	An error occurred while deleting the database.
400	ErrorRecordLog	An error occurred while updating the operation log.	An error occurred while updating the operation log.
400	ErrorParameterIpVersion	The IP version is invalid.	The IP version is invalid.
400	ErrorParametersDirection	The direction is invalid.	The direction is invalid.
400	ErrorDomainResolve	An error occurred while resolving the domain.	An error occurred while resolving the domain.
400	ErrorAclExtendedCountExceed	ACL or extended ACL rules are not matched.	The quota for access control policies or extra access control policies is exhausted.
400	ErrorAclDomainAnyCountExceed	The number of resolved domain names cannot exceed 200. ACL configuration can be continued for HTTP, HTTPS, SMTP, SMTPS, and SSL applications.	The domain name is resolved to more than 200 IP addresses. We recommend that you set Application in your access control policy to HTTPS, HTTPS, SMTP, SMTPS, or SSL.
400	ErrorMarshalJSON	An error occurred. Try again later.	An error occurred. Try again later.
400	ErrorParametersFtpNotSupport	domain destination not support ftp.	FTP application is not supported when the policy destination is a domain name
400	ErrorParametersApplicationName	Specified parameter ApplicationName is not valid.	Specified parameter ApplicationName is not valid.
400	ErrorParametersApplicationNameList	Specified parameter ApplicationNameList is not valid.	Specified parameter ApplicationNameList is not valid.
400	ErrorAddressGroupNotExist	The address group does not exist.	The address group does not exist.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.