All Products
Search

This Product

    NAT Gateway:CreateNatIpCidr

    Document Center

    NAT Gateway:CreateNatIpCidr

    Last Updated:Jun 26, 2026

    Creates a NAT CIDR block for a VPC NAT gateway instance.

    Operation description

    The CreateNatIpCidr operation does not support concurrent creation of NAT IP CIDR blocks within the same NAT gateway.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    vpc:CreateNatIpCidr

    create

    *NatGateway

    acs:vpc:{#regionId}:{#accountId}:natgateway/{#NatGatewayId}

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    RegionId

    string

    Yes

    The region ID of the NAT gateway instance to which the NAT CIDR block belongs.

    You can call the DescribeRegions operation to query the region ID.

    eu-central-1
    NatGatewayId

    string

    Yes

    The instance ID of the VPC NAT gateway for which you want to create the NAT CIDR block.

    ngw-gw8v16wgvtq26vh59****
    NatIpCidrName

    string

    No

    The name of the NAT CIDR block.

    The name must be 2 to 128 characters in length and must start with a letter or Chinese character. It can contain digits, periods (.), underscores (_), and hyphens (-). It cannot start with http:// or https://.

    newcidr
    NatIpCidrDescription

    string

    No

    The description of the NAT CIDR block.

    The description must be 2 to 256 characters in length and must start with a letter or Chinese character. It cannot start with http:// or https://.

    mycidr
    DryRun

    boolean

    No

    Specifies whether to perform a dry run. Valid values:

    • true: performs a dry run without creating the NAT CIDR block. The system checks the required parameters, request syntax, and business restrictions. If the check fails, the corresponding error is returned. If the check succeeds, the error code DryRunOperation is returned.

    • false (default): performs a dry run and sends the request. If the check succeeds, an HTTP 2xx status code is returned and the operation is performed.

    false
    ClientToken

    string

    No

    The client token that is used to ensure the idempotence of the request.

    You can use the client to generate the token, but you must make sure that the token is unique among different requests. The ClientToken value can contain only ASCII characters.

    Note

    If you do not specify this parameter, the system uses the RequestId of the API request as the ClientToken. The RequestId of each API request may be different.

    5A2CFF0E-5718-45B5-9D4D-70B3FF3898
    NatIpCidr

    string

    Yes

    The NAT CIDR block to create.

    The new CIDR block must meet the following conditions:

    • It must belong to 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 and their subnets.

    • The subnet mask must be 16 to 32 bits in length.

    • It cannot overlap with the private CIDR block of the VPC to which the VPC NAT gateway belongs. If you want to transform a private endpoint to another address within the VPC private network CIDR block, create a vSwitch in the corresponding VPC private network CIDR block, and then create a new VPC NAT gateway in the vSwitch to provide private network address translation.

    • To use a public CIDR block as the NAT CIDR block, the CIDR block must belong to the user CIDR block of the VPC to which the VPC NAT gateway belongs. For more information about user CIDR blocks, see What is a user CIDR block?.

    172.16.0.0/24
    RegionId

    string

    Yes

    The region ID of the NAT gateway instance to which the NAT CIDR block belongs.

    You can call the DescribeRegions operation to query the region ID.

    eu-central-1

    Response elements

    Element

    Type

    Description

    Example

    object

    NatIpCidrId

    string

    The instance ID of the NAT CIDR block.

    vpcnatcidr-gw8lhqtvdn4qnea****
    RequestId

    string

    The request ID.

    7021BEB1-210F-48A9-AB82-BE9A9110BB89

    Examples

    Success response

    JSON format

    {
  "NatIpCidrId": "vpcnatcidr-gw8lhqtvdn4qnea****",
  "RequestId": "7021BEB1-210F-48A9-AB82-BE9A9110BB89"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 IncorrectStatus.NatGateway The status of %s [%s] is incorrect.
    400 OperationFailed.NatIpCidrInUse The operation is failed because of %s.
    400 QuotaExceeded.NatIpCidr The quota of %s is exceeded, usage %s/%s.
    400 OperationFailed.CreateNatIpCidrInVpcCidrBlock The operation is failed because of Creating NatIpCidr in Vpc Cidr.
    400 OperationFailed.CreateNatIpCidrNotInUserCidr The operation is failed because of Creating NatIpCidr not in UserCidr. The operation failed because the NAT CIDR block does not fall within the user CIDR block.
    400 ResourceAlreadyExist.NatIpCidr The specified resource of %s is already exist.
    400 IllegalParamFormat.NatIpCidr The param format of NatIpCidr is illegal. The param format of NatIpCidr is illegal.
    404 InvalidRegionId.NotFound The specified RegionId does not exist in our records.
    404 ResourceNotFound.NatGateway The specified resource of %s is not found.
    404 ResourceNotFound.VPC The specified resource of %s is not found.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.