Call CreateIpv6EgressOnlyRule to create an IPv6 egress-only rule - Virtual Private Cloud - Alibaba Cloud - Virtual Private Cloud

Creates an IPv6 egress-only rule for an IPv6 address. You can create an egress-only rule to allow ECS instances in a VPC with an IPv6 CIDR block to proactively access IPv6 endpoints on the client side, while preventing the IPv6 endpoints from accessing ECS instances in the VPC over the Internet.

Operation description

The CreateIpv6EgressOnlyRule operation is asynchronous. After you send a request, the system returns an instance ID, but the IPv6 egress-only rule has not been created yet. The creation task is still running in the background. You can call DescribeIpv6EgressOnlyRules to query the creation status of the IPv6 egress-only rule:
- If the IPv6 egress-only rule is in the Creating state, the rule is being created.
- If the IPv6 egress-only rule is in the Created state, the rule has been created.
The CreateIpv6EgressOnlyRule operation does not support concurrent creation of egress-only rules for the same IPv6 address.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

vpc:CreateIpv6EgressOnlyRule

create

*Ipv6EgressRule

acs:vpc:{#regionId}:{#accountId}:ipv6gateway/{#Ipv6GatewayId}

None

Request parameters

Parameter	Type	Required	Description	Example
RegionId	string	Yes	The region ID of the IPv6 gateway. You can call the DescribeRegions operation to query the region ID.	cn-huhehaote
Ipv6GatewayId	string	Yes	The instance ID of the IPv6 gateway.	ipv6gw-hp3c2paq0ywauasza****
InstanceId	string	Yes	The ID of the IPv6 address for which you want to create an egress-only rule.	ipv6-hp3nxjkfxn5pnhgl5****
InstanceType	string	No	The type of the instance for which you want to create an egress-only rule. Set the value to Ipv6Address (default), which indicates the IPv6 address type.	Ipv6Address
Name	string	No	The name of the egress-only rule. The name must be 0 to 128 characters in length and cannot start with `http://` or `https://`.	rulename
Description	string	No	The description of the egress-only rule. The description must be 0 to 256 characters in length and cannot start with `http://` or `https://`.	ruledescription
ClientToken	string	No	The client token that is used to ensure the idempotence of the request. You can use the client to generate the token, but you must make sure that the token is unique among different requests. The token can contain only ASCII characters and cannot exceed 64 characters in length. Note If you do not specify this parameter, the system automatically uses the RequestId of the API request as the ClientToken. The RequestId may be different for each API request.	0c593ea1-3bea-11e9-b96b-88e9fe637760
RegionId	string	Yes	Specifies whether to perform a dry run without performing the actual request.	cn-huhehaote
DryRun	boolean	No	A dry run of the request without actually executing it.

Response elements

Element	Type	Description	Example
	object
Ipv6EgressRuleId	string	The ID of the egress-only rule.	ipv6py-hp3w98rmlbqp01245****
RequestId	string	The request ID.	9DFEDBEE-E5AB-49E8-A2DC-CC114C67AF75

Examples

Success response

JSON format

{
  "Ipv6EgressRuleId": "ipv6py-hp3w98rmlbqp01245****",
  "RequestId": "9DFEDBEE-E5AB-49E8-A2DC-CC114C67AF75"
}

Error codes

HTTP status code	Error code	Error message	Description
400	InvalidIpv6Gateway.NotFound	The specified IPv6 gateway was not found.	The specified IPv6 gateway was not found.
400	IllegalParam.Name	The param of Name [%s] is illegal.	The error message returned because the Name parameter is set to an invalid value. Specify a valid value and try again.
400	IllegalParam.Description	The parameter of Description is illegal.	The Description parameter is invalid.
400	IllegalParam.InstanceType	The parameter of InstanceType is illegal.	The InstanceType parameter is invalid.
400	OperationFailed.FinancialLocked	The operation is forbidden because of financialLocked.	The operation failed due to an overdue payment.
400	OperationUnsupported.EgressRuleVSwitch	The specified VSwitch is not supported to create egress-only rule.	The specified region does not support vSwitch-level egress-only rules.
400	InvalidIpv6Instance.NotFound	The specified resource of InvalidIpv6Instance is not found.	The error message returned because the IPv6 resource is not found.
400	OperationFailed.NoInternetBandwidth	Operation failed because the ipv6 instance has no internet bandwidth.	The operation is not supported because the IPv6 instance does not have Internet bandwidth.
400	OperationFailed.Ipv6EgressRuleExisted	An egress-only rule already exists for the IPv6 address.	The IPv6 instance already has egress-only rules.
400	OperationFailed.InternetBandwidthUnstable	The operation is forbidden because of InternetBandwidthUnstable.	The operation is prohibited because the bandwidth instance is not in a stable state.
400	IncorrectStatus.Ipv6InternetBandwidth	The status of the IPv6InternetBandwidth is incorrect.	The current state of the IPv6 Internet bandwidth does not support creating IPv6 egress-only rules.
400	OperationUnsupported.EgressRuleInDefaultSpec	Egress-only rule is not supported. Please update the spec of IPv6 Gateway to Medium or Large.	The free edition IPv6 gateway does not support creating egress-only rules. Upgrade the IPv6 gateway to Enterprise Edition or Enhanced Enterprise Edition.
400	QuotaExceeded.Ipv6EgressRules	%s quota exceeded.	Ipv6EgressRules quantity quota exceeds limit
400	Mismatch.Ipv6AddressAndIpv6Gateway	The %s and %s are mismatched.	Specified Ipv6Address and Ipv6Gateway are not in the same VPC
400	OperationUnsupported.EgressOnlyRuleOnFreeIpv6Instance	Creating ipv6 egress only rule on ipv6 instance that not associated with any resource is unsupported.	Creating egress-only rules on unbound IPv6 instances is not supported
400	MissingParam.InstanceId	The parameter InstanceId is mandatory.	You must specify the Express Connect circuit ID.
400	OperationUnsupported.ULA	%s is unsupported.	This operation does not support ULA addresses.
400	OperationUnsupported.PrivateGUA	This operation does not support private GUA addresses.	This operation does not support private GUA addresses.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.