This topic describes instance management operations, such as modifying the elastic protection capability, upgrading an instance, and renewing an instance.
Overview
The following table describes the operations that Anti-DDoS Proxy (Chinese Mainland) instances and Anti-DDoS Proxy (Outside Chinese Mainland) instances support.
|
Instance type |
Supported operation |
Description |
|
Anti-DDoS Proxy (Chinese Mainland) |
The elastic protection capability determines the maximum peak bandwidth of DDoS attacks that an Anti-DDoS Proxy (Chinese Mainland) instance can mitigate. For more information, see Billing of Anti-DDoS Proxy (Chinese Mainland). |
|
|
Burstable clean bandwidth is enabled by default, and you are not charged for enabling the feature. You are billed only when the actual peak traffic exceeds the clean bandwidth specification. For more information, see Billing of burstable clean bandwidth. |
||
|
The burstable QPS feature is enabled by default, and you are not charged for enabling the feature. You are billed on a pay-as-you-go basis only when the peak QPS of your service exceeds the purchased specification. For more information, see Billing of burstable QPS. |
||
|
If the specifications of your Anti-DDoS Proxy (Chinese Mainland) instance, such as the function plan, the number of protected domain names, the number of ports, or the clean bandwidth, no longer meet your business needs, you can upgrade the instance specifications in the Anti-DDoS Proxy (Chinese Mainland) console. |
||
|
To prevent your Anti-DDoS Proxy (Chinese Mainland) instance from being released after it expires, you can manually renew the instance or enable auto-renewal before it expires. |
||
|
This operation is supported only by Anti-DDoS Proxy (Chinese Mainland) instances that use the Advanced plan. If the advanced mitigation sessions that your Advanced plan instance provides each month cannot meet your business protection needs, you can purchase global advanced mitigation sessions. For more information, see Billing of global advanced mitigation sessions. |
||
|
You can create custom tags and add them to Anti-DDoS Proxy (Chinese Mainland) instances that serve the same purpose or have the same attributes, so that you can classify instances and search for multiple instances at a time. |
||
|
Anti-DDoS Proxy (Outside Chinese Mainland) |
Burstable clean bandwidth is enabled by default, and you are not charged for enabling the feature. You are billed only when the actual peak traffic exceeds the clean bandwidth specification. For more information, see Billing of burstable clean bandwidth. |
|
|
The burstable QPS feature is enabled by default, and you are not charged for enabling the feature. You are billed on a pay-as-you-go basis only when the peak QPS of your service exceeds the purchased specification. For more information, see Billing of burstable QPS. |
||
|
If the specifications of your Anti-DDoS Proxy (Outside Chinese Mainland) instance, such as the function plan, the number of protected domain names, the number of ports, or the clean bandwidth, no longer meet your business needs, you can upgrade the instance specifications in the Anti-DDoS Proxy (Outside Chinese Mainland) console. |
||
|
To prevent your Anti-DDoS Proxy (Outside Chinese Mainland) instance from being released after it expires, you can manually renew the instance or enable auto-renewal before it expires. |
||
|
This operation is supported only by Anti-DDoS Proxy (Outside Chinese Mainland) instances that use the Insurance plan, the secure acceleration line plan (Secure Chinese Mainland Acceleration (Sec-CMA)), or the Sec-CMA (Basic) mitigation plan. If the advanced mitigation sessions that the preceding instances provide each month cannot meet your business protection needs, you can purchase global advanced mitigation sessions. For more information, see Billing of global advanced mitigation sessions. |
Modify the elastic protection capability
An Anti-DDoS Proxy (Chinese Mainland) instance allows you to configure a basic protection bandwidth and an elastic protection capability, and the elastic protection capability must be greater than or equal to the basic protection bandwidth.
If you do not configure the elastic protection capability, the basic protection bandwidth is the maximum peak bandwidth of DDoS attacks that the instance can mitigate. If you configure the elastic protection capability, the elastic protection capability is the maximum peak bandwidth of DDoS attacks that the instance can mitigate.
You can adjust the basic protection bandwidth only by upgrading the Anti-DDoS Proxy (Chinese Mainland) instance. You can modify the elastic protection capability at any time in the Anti-DDoS Proxy (Chinese Mainland) console, or adjust it by upgrading the Anti-DDoS Proxy (Chinese Mainland) instance.
Log on to the Anti-DDoS Proxy console.
In the left-side navigation pane, choose .
-
Find the instance that you want to manage. In the Instance Status column, find Protection Bandwidth: and click the
icon. -
In the Modify Burstable Clean Bandwidth dialog box, select an elastic protection capability for the instance, and then click OK.
NoteThe maximum elastic protection capability that you can configure varies with the basic protection bandwidth of the instance. If the maximum configurable elastic protection capability still cannot meet your business needs, upgrade the basic protection bandwidth of the instance. For more information, see Upgrade an instance.
Configure burstable clean bandwidth
If your normal service traffic fluctuates significantly or has short-term spikes, you can use burstable clean bandwidth to avoid frequent specification upgrades and downgrades.
Starting from 10:00:00 (UTC+8) on March 6, 2026, the monthly 95th percentile method for burstable clean bandwidth is no longer available for new purchases. You can no longer manually adjust the burstable clean bandwidth settings in the console (disabling or enabling the feature, or changing the billing method or bandwidth specification). For more information, see [Important] Adjustments to Anti-DDoS burstable billing feature.
Formula: burstable bandwidth peak = min(base Clean Bandwidth × 10, burstable bandwidth limit).
NoteThe burstable peak represents the upper limit of the burstable resources allocated by default. After actual usage exceeds the burstable peak, the service continues to make best efforts to serve you and generates burstable pay-as-you-go fees based on actual usage. However, packet loss may occur while the cluster scales out. Promptly upgrade the base clean bandwidth.
Burstable bandwidth limit:
Anti-DDoS Proxy (Chinese Mainland): Profession (20,000 Mbps), Advanced (20,000 Mbps)
Anti-DDoS Proxy (Outside Chinese Mainland): Insurance (5000 Mbps), Unlimited (5000 Mbps), Sec-CMA 2.0 (2000 Mbps), Chinese Mainland Acceleration (1000 Mbps), Sec-CMA 1.0 (500 Mbps)
Procedure
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose .
-
For the target instance, in the Instance Specification column, find Burstable Clean Bandwidth and click the
icon. -
In the Burstable Clean Bandwidth dialog box, configure the parameters, and then click OK.
Operation type
Procedure
Enable burstable clean bandwidth
Turn on the Enable Burstable Clean Bandwidth switch, and then set Metering Method and Burstable Clean Bandwidth.
Modify burstable clean bandwidth
-
Modify Metering Method
After the modification is complete, Metering Method displays the mode that you selected and prompts (The metering method is changed and the new metering method takes effect next month.). The modified metering method takes effect at 00:00 on the first day of the next month. You can modify the metering method up to three times per calendar month, and the mode that takes effect in the next month is the result of your last modification. You cannot switch the metering method on the last day of a calendar month.
-
Modify Burstable Clean Bandwidth
Disable burstable clean bandwidth
Turn off the Enable Burstable Clean Bandwidth switch. You can disable burstable clean bandwidth only once per month.
-
Configure burstable QPS
If your normal service QPS fluctuates frequently or has short-term spikes, you can use burstable QPS to avoid frequent specification upgrades and downgrades.
Starting from 10:00:00 UTC+8 on March 6, 2026, new customers can no longer enable the monthly 95th percentile billing mode for burstable QPS. You also cannot manually adjust burstable QPS settings in the console, including enabling or disabling the feature, changing the billing mode, or modifying the specification. For more information, see [Update] Announcement on changes to the burstable billing feature for Anti-DDoS on March 6, 2026.
-
Formula: Burstable QPS peak = min(Clean QPS × 3, Burstable QPS limit).
NoteThe elastic peak is the upper limit for the elastic resources allocated by default. If your actual usage exceeds the elastic peak, the service is provided on a best-effort basis and you are charged for the elastic resources that you use on a pay-as-you-go basis. However, there is a risk of throttling. To ensure resource reservation beyond the burstable peak, upgrade the clean QPS in advance or contact your account manager for capacity expansion.
-
Burstable QPS limit:
-
The Chinese mainland:
-
IPv4 Anti-DDoS Proxy instance: maximum burstable QPS is 300,000.
-
IPv6 Anti-DDoS Proxy instance: maximum burstable QPS is 100,000.
-
-
Outside the Chinese mainland: maximum burstable QPS is 150,000.
-
QPS specifications and corresponding connection limits
Each QPS tier has corresponding connection limits. If burstable QPS is enabled, the burstable tier's limits apply.
QPS | New connections | Concurrent connections |
0 < QPS ≤ 5,000 | 5,000 | 100,000 |
5,000 < QPS ≤ 10,000 | 10,000 | 200,000 |
10,000 < QPS ≤ 30,000 | 30,000 | 500,000 |
30,000 < QPS ≤ 50,000 | 50,000 | 1,000,000 |
50,000 < QPS ≤ 100,000 | 80,000 | 1,500,000 |
100,000 < QPS ≤ 150,000 | 100,000 | 2,000,000 |
150,000 < QPS ≤ 200,000 Note Supported only by Anti-DDoS Proxy (Chinese Mainland). | 150,000 | 3,000,000 |
200,000 < QPS ≤ 300,000 Note Supported only by Anti-DDoS Proxy (Chinese Mainland). | 200,000 | 4,000,000 |
Procedure
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose .
-
For the target instance, in the Instance Specification column, find Burstable QPS and click the
icon. -
In the Burstable QPS dialog box, configure the parameters, and then click OK.
Operation type
Procedure
Enable burstable QPS
Turn on the Enable Burstable QPS switch, and then set Metering Method. Burstable QPS Specifications cannot be configured.
Modify burstable QPS
You can modify only Metering Method.
After the modification, the metering method that you selected is chosen, and the system prompts (The metering method is changed and the new metering method takes effect next month.). The modified metering method takes effect at 00:00 on the first day of the next month. You cannot switch the metering method on the last day of a calendar month.
Disable burstable QPS
Turn off the Enable Burstable QPS switch. You can disable burstable QPS only once per month.
Upgrade an instance
Upgrading an instance increases the specifications of your current Anti-DDoS Proxy instance. You must pay the price difference of the upgraded specifications for the remaining validity period of the instance.
Anti-DDoS Proxy instances can only be upgraded and cannot be downgraded (that is, you cannot lower the specifications of your current Anti-DDoS Proxy instance). An upgraded instance also cannot be downgraded to its original specifications.
Procedure
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose .
-
Find the Anti-DDoS Proxy instance that you want to upgrade. In the Actions column, click Upgrade.
-
On the Upgrade page, increase the specifications of the instance as needed, carefully read the Terms of Service, and then click Buy Now to complete the payment.
Renew an instance
Before an Anti-DDoS Proxy instance is released, you can manually renew the instance to extend its validity period. To prevent your business from being affected because you forget to renew the instance in time, you can also enable auto-renewal before the instance expires. Alibaba Cloud then automatically renews the instance before it expires.
Manual renewal
Before an Anti-DDoS Proxy instance is released, you can manually renew the instance and continue to use its original configurations. If an Anti-DDoS Proxy instance is already released, manual renewal is not supported.
We recommend that you manually renew your instance within the following time frames:
-
Anti-DDoS Proxy (Chinese Mainland) instance: We recommend that you renew the Anti-DDoS Proxy (Chinese Mainland) instance before it expires, or at most within 7 calendar days after it expires, to avoid affecting traffic forwarding of your service.
-
Anti-DDoS Proxy (Outside Chinese Mainland) instance: We recommend that you renew the Anti-DDoS Proxy (Outside Chinese Mainland) instance before it expires, or at most within 30 calendar days after it expires, to avoid affecting traffic forwarding of your service.
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose .
-
Find the Anti-DDoS Proxy instance that you want to renew. In the Actions column, click Renew.
-
On the Renew page, set Purchase Duration (which indicates the renewal duration), carefully read and select the Terms of Service, and then click Buy Now to complete the payment.
Enable auto-renewal
You can enable auto-renewal only when your Anti-DDoS Proxy instance is 2 or more calendar days away from expiration. If your Anti-DDoS Proxy instance expires the next day, use manual renewal.
Log on to the Anti-DDoS Proxy console.
-
In the top navigation bar, choose Expenses > Renewal Management.
-
On the Manual Renewal tab, find the Anti-DDoS Proxy instance that you want to renew. In the Actions column, click Enable Auto-renewal.
-
In the Enable Auto-renewal dialog box, select Auto-renewal Cycle, and then click Enable Auto-renewal.
After auto-renewal is enabled, you can view the auto-renewal configuration of the instance on the Auto-renewal tab. Alibaba Cloud deducts the required fees from your Alibaba Cloud account 9 calendar days before the instance expires. If you no longer need auto-renewal, you can go to the Auto-renewal tab and perform the Switch to Manual Renewal operation for the instance.
Purchase global advanced mitigation sessions
After you purchase global advanced mitigation sessions, if the DDoS attacks against your service exceed the advanced mitigation sessions that the instance provides, the system automatically uses the purchased sessions for mitigation, which prevents your service from being affected.
-
To purchase global advanced mitigation sessions for the Advanced plan, log on to the Anti-DDoS Proxy (Chinese Mainland) console.
-
To purchase global advanced mitigation sessions for the Insurance plan or the secure acceleration line plan, log on to the Anti-DDoS Proxy (Outside Chinese Mainland) console.
The following steps use the purchase of global advanced mitigation sessions for an Anti-DDoS Proxy (Outside Chinese Mainland) instance that uses the Insurance plan or the secure acceleration line plan as an example.
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose .
-
In the upper-right corner of the Instances page, click Purchase.
-
On the Global Advanced Mitigation (Anti-DDoS Pro and Anti-DDoS Premium) purchase page, set Applicable Service to Anti-DDoS Proxy (Outside Chinese Mainland) Insurance or Anti-DDoS Proxy (Outside Chinese Mainland) Sec-CMA, and then select Quantity for the number of global advanced mitigation sessions that you want to purchase.
-
Click Buy Now and complete the payment.
-
View the purchase result. After you purchase global advanced mitigation sessions, you can use one of the following methods to confirm the result.
-
In the upper-right corner of the instance list, view the number of advanced mitigation sessions that are currently available for the Insurance plan and the secure acceleration line plan.
-
Click Details to view detailed information about the global advanced mitigation sessions, such as the activation time, expiration time, and usage.
-
Manage instance tags
An instance tag consists of a key-value pair. You can add tags to instances to quickly classify and search for them.
Log on to the Anti-DDoS Proxy console.
In the left-side navigation pane, choose .
-
On the Instances page, you can perform the following operations.
Operation
Procedure
Add tags to an instance
-
On the Instances page, find the target instance. In the Tag column, click the
icon. -
In the Edit Tag dialog box, add tags to the instance, and then click OK. The following methods are supported:
-
Select Tag: select the tag key and tag value that you want to use from the existing tag list.
-
Add Tag: set a new Tag Key and Tag Value, and then click OK.
-
NoteYou can add up to 20 tags to an instance. Each tag key on an instance must be unique, and a tag value of an existing tag key is overwritten.
Search for instances by tag
On the Instances page, select a tag key and a tag value in the tag filter box.
Delete a tag
You can delete tags only from one instance at a time. Deleting tags from multiple instances at a time is not supported.
-
On the Instances page, find the target instance. In the Tag column, click the
icon. -
In the Edit Tag dialog box, click the
icon of the tag that you want to remove, and then click OK.
NoteAfter a tag is removed from an instance, the system automatically deletes the tag if its tag key is not associated with other instances.
-