ModifyACLRule - Smart Access Gateway - Alibaba Cloud Documentation Center

The ModifyACLRule operation modifies an access control rule.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

smartag:ModifyACLRule

update

*Acl

acs:smartag:{#regionId}:{#accountId}:acl/{#AclId}

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the access control list (ACL) instance.	cn-shanghai
AclId	string	Yes	The ID of the ACL instance.	acl-xhwhyuo43l0n*******
AcrId	string	Yes	The ID of the access control rule. Call the DescribeACLAttribute operation to query the IDs of access control rules in an ACL instance.	acr-u98qztgtgvhb********
Description	string	No	The description of the access control rule. The description must be 1 to 512 characters in length.	test
Direction	string	No	The direction in which the access control rule is applied. Valid values: in: inbound. This is the direction of traffic from an external network to the on-premises network where the Smart Access Gateway instance is deployed. out: outbound. This is the direction of traffic from the on-premises network where the Smart Access Gateway instance is deployed to an external network.	in
SourceCidr	string	No	The source CIDR block. The source CIDR block must be in CIDR format. For example: 192.168.1.0/24.	0.0.0.0/0
DestCidr	string	No	The destination CIDR block. The destination CIDR block must be in CIDR format. For example: 192.168.10.0/24.	0.0.0.0/0
IpProtocol	string	No	The protocol used by the access control rule. For the protocols supported by the access control feature, see the information in the console. The protocol is not case-sensitive.	tcp
SourcePortRange	string	No	The source port range. Valid values: -1 or 1 to 65535. Examples of the source port range format: 1/200: ports 1 to 200. 80/80: port 80. -1/-1: all ports.	80/80
DestPortRange	string	No	The destination port range. Valid values: -1 or 1 to 65535. Examples of the destination port range format: 1/200: ports 1 to 200. 80/80: port 80. -1/-1: all ports.	80/80
Policy	string	No	The authorization policy of the access control rule. Valid values: accept: allows access. drop: denies access.	accept
Priority	integer	No	The priority of the access control rule. A smaller value indicates a higher priority. If rules have the same priority, the one that is first delivered to the Smart Access Gateway device takes precedence. Valid values: 1 to 100. Default value: 1.	2
Type	string	No	The type of the access control rule. Valid values: LAN: (Default) private network. This value indicates that the access control rule applies to traffic from private IP addresses. WAN: public network. This value indicates that the access control rule applies to traffic from public IP addresses.	LAN
Name	string	No	The name of the access control rule. The name must be 2 to 128 characters in length, start with a letter or a Chinese character, and can contain digits, underscores (_), and hyphens (-).	doctest
DpiSignatureIds	array	No	A list of application IDs that the access control rule matches.
	string	No	The application ID that the access control rule matches. Call ListDpiSignatures to query application IDs and their corresponding application information.	1
DpiGroupIds	array	No	A list of application group IDs that the access control rule matches.
	string	No	The application group ID that the access control rule matches. Call ListDpiGroups to query application group IDs and the applications they contain.	20

Response parameters

Parameter	Type	Description	Example
	object	The response parameters.
Policy	string	The authorization policy of the access control rule. accept: allows access. drop: denies access.	accept
Description	string	The description of the access control rule.	test
RequestId	string	The request ID.	7F3DD2C1-0F6B-4575-9106-B2D50DF7A711
SourcePortRange	string	The source port range.	-1/-1
SourceCidr	string	The source CIDR block. The source CIDR block is in CIDR format. For example: 192.168.1.0/24.	0.0.0.0/0
Priority	integer	The priority of the access control rule. A smaller value indicates a higher priority. If rules have the same priority, the one that is first delivered to the Smart Access Gateway device takes precedence.	1
AclId	string	The ID of the ACL instance.	acl-jdc7tir4fkplwr****
AcrId	string	The ID of the access control rule.	acr-r8hezn2pi39s5a****
DestPortRange	string	The destination port range.	-1/-1
Direction	string	The direction in which the access control rule is applied. Valid values: in: inbound. This is the direction of traffic from an external network to the on-premises network where the Smart Access Gateway instance is deployed. out: outbound. This is the direction of traffic from the on-premises network where the Smart Access Gateway instance is deployed to an external network.	in
DpiGroupIds	object
DpiGroupId	array	A list of application group IDs that the access control rule matches.
	string	The application group ID that the access control rule matches.	20
Name	string	The name of the access control rule.	doctest
GmtCreate	integer	The timestamp that indicates when the access control rule was created. The value is a UNIX timestamp. If rules have the same priority, the one with the smaller timestamp takes precedence.	1553777700000
DestCidr	string	The destination CIDR block. The destination CIDR block is in CIDR format. For example: 192.168.10.0/24.	0.0.0.0/0
DpiSignatureIds	object
DpiSignatureId	array	A list of application IDs that the access control rule matches.
	string	The application ID that the access control rule matches.	1
IpProtocol	string	The protocol used by the access control rule.	ALL

Examples

Success response

JSON format

{
  "Policy": "accept",
  "Description": "test",
  "RequestId": "7F3DD2C1-0F6B-4575-9106-B2D50DF7A711",
  "SourcePortRange": "-1/-1",
  "SourceCidr": "0.0.0.0/0",
  "Priority": 1,
  "AclId": "acl-jdc7tir4fkplwr****",
  "AcrId": "acr-r8hezn2pi39s5a****",
  "DestPortRange": "-1/-1",
  "Direction": "in",
  "DpiGroupIds": {
    "DpiGroupId": [
      "20"
    ]
  },
  "Name": "doctest",
  "GmtCreate": 1553777700000,
  "DestCidr": "0.0.0.0/0",
  "DpiSignatureIds": {
    "DpiSignatureId": [
      "1"
    ]
  },
  "IpProtocol": "ALL"
}

Error codes

HTTP status code	Error code	Error message	Description
400	ACL.NoSupportWanType	An SAG 1000 device does not support a WAN ACL.	An SAG 1000 device does not support a WAN ACL.
400	ACL.InvalidType	The specified ACL type is invalid.	The specified ACL type is invalid.
403	Forbidden	User not authorized to operate on the specified resource.	You do not have permissions to manage the specified resource.
403	MissingParameter	The input parameter is missing, please check your input.	Missing parameters. Check whether all required parameters are set.
403	InvalidDescription	Description not valid.	The length of the description has exceeded the upper limit.
403	InvalidParameter	The specified parameter is invalid.	Invalid parameters.
403	FeatureNotSupport	The current edition of the smart access gateway does not support this feature.	The current version of Smart Access Gateway does not support this feature.
403	FeatureNotSupportForActiveSmartAG	The current edition of the active smart access gateway does not support this feature.	The current edition of the active SAG instance does not support this feature.
403	FeatureNotSupportForStandBySmartAG	The current edition of the standby smart access gateway does not support this feature.	The current version of Smart Access Gateway does not support this feature.
403	NotSupportedProtocol	The specified protocol of the ACL rule is not supported.	The specified protocol of the ACL rule is not supported.
403	InvalidId.ACL	The specified ACL ID is invalid.	The specified ACL group ID is invalid.
403	InvalidId.ACR	The specified ACL rule ID is invalid.	The specified ACL rule ID is invalid.
403	InvalidPortRange	The specified port range is invalid.	The specified port range is invalid.
403	InternalError	An internal server error occurred.	An internal server error occurred.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.