All Products
Search

This Product

    ENS:CreateSecurityGroupPermissions

    Document Center

    ENS:CreateSecurityGroupPermissions

    Last Updated:Apr 09, 2026

    Creates an Edge Node Service (ENS) security group rule.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    ens:CreateSecurityGroupPermissions

    create

    *All Resource

    *

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    SecurityGroupId

    string

    Yes

    The ID of the security group.

    sg-bp67acfmxazb4p****
    Permissions

    array<object>

    Yes

    A collection of security group rule objects.

    object

    No

    A security group rule.

    Direction

    string

    Yes

    The traffic direction for the rule. Valid values:

    • egress: Outgoing traffic.

    • ingress: Incoming traffic.

    ingress
    IpProtocol

    string

    Yes

    The protocol type. Valid values:

    • TCP

    • UDP

    • ICMP

    • ICMPv6

    • ALL: All protocols.

    TCP
    PortRange

    string

    Yes

    The destination port range for the rule.

    • For TCP and UDP, the port range is 1 to 65535. Use a forward slash (/) to separate the start and end ports. For example, 1/200.

    • For ICMP, the value must be -1/-1.

    • For ICMPv6, the value must be -1/-1.

    • If you set IpProtocol to ALL, the value must be -1/-1.

    80/80
    SourcePortRange

    string

    No

    The source port range for the rule.

    • For TCP and UDP, the port range is 1 to 65535. Use a forward slash (/) to separate the start and end ports. For example, 1/200.

    • For ICMP, the value must be -1/-1.

    • For ICMPv6, the value must be -1/-1.

    • If you set IpProtocol to ALL, the value must be -1/-1.

    22/22
    Policy

    string

    Yes

    The access control policy. Valid values:

    • Accept: Allows matching traffic.

    • Drop: Denies matching traffic and drops the packets.

    Accept
    DestCidrIp

    string

    No

    The destination IPv4 CIDR block. This parameter supports CIDR notation and single IPv4 addresses.

    10.XX.XX.14/32
    SourceCidrIp

    string

    No

    The source IPv4 CIDR block. This parameter supports CIDR notation and single IPv4 addresses.

    0.0.0.0/0
    Description

    string

    No

    The description of the security group rule. It must be 2 to 256 characters long and cannot start with http:// or https://.

    testDescription
    Priority

    integer

    Yes

    The priority of the security group rule. A smaller value indicates a higher priority. Valid values: 1 to 100.

    1
    Ipv6SourceCidrIp

    string

    No

    The source IPv6 CIDR block. This parameter supports CIDR notation and single IPv6 addresses.

    Note

    This parameter and SourceCidrIp are mutually exclusive.

    ::/0
    Ipv6DestCidrIp

    string

    No

    The destination IPv6 CIDR block. This parameter supports CIDR notation and single IPv6 addresses.

    Note

    This parameter and DestCidrIp are mutually exclusive.

    ::/0

    Response elements

    Element

    Type

    Description

    Example

    object

    The response object.

    RequestId

    string

    The ID of the request.

    CEF72CEB-54B6-4AE8-B225-F876FF7BA984

    Examples

    Success response

    JSON format

    {
  "RequestId": "CEF72CEB-54B6-4AE8-B225-F876FF7BA984"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 ens.interface.error Failed to call API.
    400 InvalidParameter.PortRange The parameter PortRange is not valid. The port range is not configured correctly.
    400 AuthorizationLimitExceed The limit of authorization records in the security group reaches. The number of security group rules exceeds the limit.
    400 InvalidSecurityGroupId.NotFound The specified SecurityGroupId does not exist. The specified security group ID does not exist.
    400 SecurityGroupRuleConflict.Duplicated The SecurityGroup rule already exists. duplicate security group rules.
    400 InvalidParameter.CidrIp The parameter CidrIp is not valid. The security group rule CIDR block parameter is invalid.
    400 NoPermission Permission denied.
    400 InvalidParameter.SourceIpConflict The Parameters SourceCidrIp and Ipv6SourceCidrIp cannot be set at the same time. Parameter SourceCidrIp and Ipv6SourceCidrIp cannot be set at the same time.
    400 InvalidParameter.DestIpConflict The Parameters DestCidrIp and Ipv6DestCidrIp cannot be set at the same time. Parameter DestCidrIp and Ipv6DestCidrIp cannot be set at the same time.
    400 InvalidParameter.Ipv4ProtocolConflictWithIpv6Address IPv6 address cannot be specified for IPv4-specific protocol. The IPv4 protocol cannot specify an IPv6 address.
    400 InvalidParameter.Ipv6ProtocolConflictWithIpv4Address IPv4 address cannot be specified for IPv6-specific protocol. The IPv6 protocol cannot specify an IPv4 address.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.