All Products
Search

This Product

    ENS:DescribeNetworkAcls

    Document Center

    ENS:DescribeNetworkAcls

    Last Updated:Mar 27, 2026

    You can invoke the DescribeNetworkAcls API to query created network ACLs.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    ens:DescribeNetworkAcls

    list

    *All Resource

    *

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    NetworkAclId

    string

    No

    The ID of the network ACL.

    nacl-bp1lhl0taikrbgnh****
    NetworkAclName

    string

    No

    The name of the network ACL.

    acl-1
    ResourceId

    string

    No

    The ID of the associated instance.

    n-5****
    PageNumber

    string

    No

    The page number. Pages start from page 1. Default value: 1.

    1
    PageSize

    string

    No

    The number of entries per page. Maximum value: 50. Default value: 10.

    10

    Response elements

    Element

    Type

    Description

    Example

    object

    Schema of Response

    RequestId

    string

    The ID of the request.

    A1707FC0-430C-423A-B624-284046B20399
    TotalCount

    string

    The total number of entries returned.

    3
    PageSize

    string

    The number of entries per page.

    2
    PageNumber

    string

    The page number.

    1
    NetworkAcls

    array<object>

    Details of the network ACLs.

    array<object>

    Status

    string

    The status of the network ACL. Valid values:

    • Available: The network ACL is available.

    • Modifying: The network ACL is being configured.

    Available
    CreationTime

    string

    The time when the network ACL was created. The time follows the ISO 8601 standard in the yyyy-MM-ddTHH:mm:ssZ format. The time is displayed in UTC.

    2019-11-01T06:08:46Z
    Description

    string

    The description of the network ACL.

    This is my NetworkAcl.
    NetworkAclId

    string

    The ID of the network ACL.

    nacl-a2do9e413e0spxscd****
    NetworkAclName

    string

    The name of the network ACL.

    acl-8
    IngressAclEntries

    array<object>

    Details of the inbound rules.

    object

    Policy

    string

    The action that is performed on network traffic that matches the rule. Valid values:

    • accept: allows the network traffic.

    • drop: blocks the network traffic.

    accept
    NetworkAclEntryId

    string

    The ID of the inbound rule.

    nae-5dk86arlydmezasw****
    NetworkAclEntryName

    string

    The name of the inbound rule.

    acl-3
    CidrBlock

    string

    The source CIDR block.

    10.0.0.0/24
    Protocol

    string

    The protocol type. Valid values:

    • icmp: ICMP.

    • tcp: TCP.

    • udp: UDP.

    • all: all protocols.

    all
    PortRange

    string

    The destination port range of the inbound rule.

    • If Protocol of the inbound rule is set to all or icmp, the port range is -1/-1, which indicates all ports.

    • If Protocol of the inbound rule is set to tcp or udp, the port range is in the following format: 1/200 or 80/80. 1/200 indicates port 1 to port 200. 80/80 indicates port 80. Valid values for a port: 1 to 65535.

    -1/-1
    Priority

    integer

    The priority of the rule. Valid values: 1 to 100. Default value: 1.

    1
    Type

    string

    The type of the rule. Valid values:

    • system: The rule is created by the system.

    • custom: The rule is created by a user.

    system
    Description

    string

    The description of the inbound rule.

    This is IngressAclEntries.
    DestinationCidrBlock

    string

    The destination network.

    10.0.0.0/24
    EgressAclEntries

    array<object>

    Details of the outbound rules.

    object

    Policy

    string

    The action that is performed on network traffic that matches the rule. Valid values:

    • accept: allows the network traffic.

    • drop: blocks the network traffic.

    accept
    NetworkAclEntryId

    string

    The ID of the outbound rule.

    nae-a2d447uw4tillfvgb****
    NetworkAclEntryName

    string

    The name of the outbound rule.

    acl-2
    CidrBlock

    string

    The destination CIDR block.

    10.0.0.0/24
    Protocol

    string

    The protocol type. Valid values:

    • icmp: ICMP.

    • tcp: TCP.

    • udp: UDP.

    • all: all protocols.

    all
    PortRange

    string

    The destination port range of the outbound rule.

    • If Protocol of the outbound rule is set to all or icmp the port range is -1/-1, which indicates all ports.

    • If Protocol of the outbound rule is set to tcp or udp, the port range is in the following format: 1/200 or 80/80. 1/200 indicates port 1 to port 200. 80/80 indicates port 80. Valid values for a port: 1 to 65535.

    -1/-1
    Priority

    integer

    The priority of the rule. Valid values: 1 to 100. Default value: 1.

    1
    Type

    string

    The type of the rule. Valid values:

    • system: The rule is created by the system.

    • custom: The rule is created by a user.

    system
    Description

    string

    The description of the outbound rule.

    This is EgressAclEntries.
    Resources

    array<object>

    Details of the associated resources.

    object

    Status

    string

    The association status of the resource. Valid values:

    • BINDED: The resource is associated with the network ACL.

    • BINDING: The resource is being associated with the network ACL.

    • UNBINDING: The resource is being disassociated from the network ACL.

    BINDING
    ResourceType

    string

    The type of the associated resource.

    Network
    ResourceId

    string

    The ID of the associated resource.

    n-****
    EnsRegionId

    string

    The ID of the edge node.

    cn-fuzhou-telecom

    Examples

    Success response

    JSON format

    {
  "RequestId": "A1707FC0-430C-423A-B624-284046B20399",
  "TotalCount": "3",
  "PageSize": "2",
  "PageNumber": "1",
  "NetworkAcls": [
    {
      "Status": "Available",
      "CreationTime": "2019-11-01T06:08:46Z",
      "Description": "This is my NetworkAcl.",
      "NetworkAclId": "nacl-a2do9e413e0spxscd****",
      "NetworkAclName": "acl-8",
      "IngressAclEntries": [
        {
          "Policy": "accept",
          "NetworkAclEntryId": "nae-5dk86arlydmezasw****",
          "NetworkAclEntryName": "acl-3",
          "CidrBlock": "10.0.0.0/24",
          "Protocol": "all",
          "PortRange": "-1/-1",
          "Priority": 1,
          "Type": "system",
          "Description": "This is IngressAclEntries.",
          "DestinationCidrBlock": "10.0.0.0/24"
        }
      ],
      "EgressAclEntries": [
        {
          "Policy": "accept",
          "NetworkAclEntryId": "nae-a2d447uw4tillfvgb****",
          "NetworkAclEntryName": "acl-2",
          "CidrBlock": "10.0.0.0/24",
          "Protocol": "all",
          "PortRange": "-1/-1",
          "Priority": 1,
          "Type": "system",
          "Description": "This is EgressAclEntries."
        }
      ],
      "Resources": [
        {
          "Status": "BINDING",
          "ResourceType": "Network",
          "ResourceId": "n-****",
          "EnsRegionId": "cn-fuzhou-telecom"
        }
      ]
    }
  ]
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 NoPermission Permission denied.
    400 ens.interface.error Failed to call API.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.