Modify network ACL rules using UpdateNetworkAclEntries - Virtual Private Cloud - Alibaba Cloud - Virtual Private Cloud

Updates the rules of a network access control list (ACL).

Operation description

UpdateNetworkAclEntries 接口属于异步接口，即系统返回一个请求 ID，但该网络 ACL 规则尚未更新成功，系统后台的更新任务仍在进行。您可以调用 DescribeNetworkAclAttributes 查询网络 ACL 规则的更新状态：
- 当网络 ACL 规则处于 Modifying 状态时，表示网络 ACL 规则正在更新中。
- 当网络 ACL 规则处于 Available 状态时，表示网络 ACL 规则更新成功。
UpdateNetworkAclEntries 接口不支持并发更新同一个网络 ACL 规则。

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter	Type	Required	Description	Example
IngressAclEntries	array<object>	No	Information about the inbound rules.
	object	No	Information about the inbound rules.
NetworkAclEntryId	string	No	The ID of the inbound rule. Valid values of N: 0 to 99. You can specify at most 100 inbound rule IDs.	nae-2zepn32de59j8m4****
EntryType	string	No	The rule type. Set the value to custom.	custom
NetworkAclEntryName	string	No	The name of the inbound rule. The name must be 1 to 128 characters in length and cannot start with `http://` or `https://`.	acl-3
Policy	string	No	The access control policy. Valid values: accept: allows network traffic. drop Valid values: drop : drop accept : accept	accept
SourceCidrIp	string	No	The source CIDR block. You can also specify a prefix list ID.	10.0.0.0/24 pl-xxxxxx
IpVersion	string	No	The IP version: IPv4 IPv6 Valid values: IPv6 : IPv6 IPv4 : IPv4	IPv4
Description	string	No	The description of the inbound rule. The description must be 1 to 256 characters in length and cannot start with `http://` or `https://`.	This is IngressAclEntries.
Protocol	string	No	The protocol type. Valid values: icmp gre tcp udp all icmpv6 Valid values: all : all tcp : tcp udp : udp gre : gre icmp : icmp icmpv6 : icmpv6	all
Port	string	No	The source port range of the inbound rule. If Protocol is set to all, icmp, or gre, the port range is -1/-1, which indicates all ports are available. If Protocol is set to tcp or udp, valid port numbers are 1 to 65535. Format: 1/200 (port 1 to 200) or 80/80 (port 80).	-1/-1
EgressAclEntries	array<object>	No	Information about the outbound rules.
	object	No	Information about the outbound rules.
NetworkAclEntryId	string	No	The ID of the outbound rule. Valid values of N: 0 to 99. You can specify at most 100 outbound rule IDs.	nae-2zecs97e0brcge46****
EntryType	string	No	The rule type. Set the value to custom.	custom
NetworkAclEntryName	string	No	The name of the outbound rule. The name must be 1 to 128 characters in length and cannot start with `http://` or `https://`.	acl-2
Policy	string	No	The access control policy. Valid values: accept drop Valid values: drop : drop accept : accept	accept
Description	string	No	The description of the outbound rule. The description must be 1 to 256 characters in length and cannot start with `http://` or `https://`.	This is EgressAclEntries.
Protocol	string	No	The protocol type. Valid values: icmp gre tcp udp all icmpv6 Valid values: all : all tcp : tcp udp : udp gre : gre icmp : icmp icmpv6 : icmpv6	all
DestinationCidrIp	string	No	The destination CIDR block. You can also specify a prefix list ID.	10.0.0.0/24 pl-xxxxxx
IpVersion	string	No	The IP version: IPv4 IPv6 Valid values: IPv6 : IPv6 IPv4 : IPv4	IPv4
Port	string	No	The destination port range of the outbound rule. If Protocol is set to all, icmp, or gre, the port range is -1/-1, which indicates all ports are available. If Protocol is set to tcp or udp, valid port numbers are 1 to 65535. Format: 1/200 (port 1 to 200) or 80/80 (port 80).	-1/-1
UpdateIngressAclEntries	boolean	No	Whether to update inbound rules. Valid values: true false (default) Note This parameter cannot be used to add inbound rules to ACLs. If you want to add more inbound rules to ACLs, you must specify both the existing rule and the rule that you want to add when you call this API operation. If you specify only the rule that you want to add, it overwrites the existing rule.	false
UpdateEgressAclEntries	boolean	No	Whether to update outbound rules. Valid values: true false (default) Note This parameter cannot be used to add outbound rules to ACLs. If you want to add more outbound rules to ACLs, specify both the existing rule and the rule that you want to add when you call this API operation. If you specify only the rule that you want to add, it overwrites the existing rule.	false
NetworkAclId	string	Yes	The ID of the network ACL.	nacl-bp1lhl0taikrzxsc****
RegionId	string	Yes	The region ID of the network ACL. You can call the DescribeRegions operation to query the most recent region list.	cn-hangzhou
ClientToken	string	No	The client token used to ensure the idempotence of the request. You can use the client to generate the token, but you must ensure that the token is unique across requests. The token can contain only ASCII characters. Note If you do not specify this parameter, the system automatically uses the request ID as the client token. The request ID may be different for each request.	123e4567-e89b-12d3-a456-426655440000
DryRun	boolean	No	Whether to perform only a dry run, without performing the actual request. Valid values: true: performs a dry run. The system checks the request for potential issues, including the AccessKey pair, the permissions of the RAM user, and the required parameters. If the request fails the dry run, an error message is returned. If the request passes the dry run, the `DryRunOperation` error code is returned. false (default): performs a dry run and performs the actual request. If the request passes the dry run, a 2xx HTTP status code is returned and the operation is performed.	true
RegionId	string	Yes	The region ID of the network ACL. You can call the DescribeRegions operation to query the most recent region list.	cn-hangzhou

Response elements

Element	Type	Description	Example
	object
RequestId	string	The request ID.	1170A5A0-E760-4331-9133-A7D38D973215

Examples

Success response

JSON format

{
  "RequestId": "1170A5A0-E760-4331-9133-A7D38D973215"
}

Error codes

HTTP status code	Error code	Error message	Description
400	ParameterMissing.AliUid	ParameterMissing.AliUid
400	ParameterMissing.Bid	ParameterMissing.Bid
400	ParameterMissing.RegionId	ParameterMissing.RegionId
400	ParameterEmpty.RegionId	ParameterEmpty.RegionId
400	ParameterMissing.NetworkAclId	ParameterMissing.NetworkAclId
400	ParameterEmpty.NetworkAclId	ParameterEmpty.NetworkAclId
400	ParameterMissing.Port	ParameterMissing.Port
400	ParameterIllegal.Port	ParameterIllegal.Port
400	ParameterIllegal.Policy	ParameterIllegal.Policy
400	ParameterMissing.Policy	ParameterMissing.Policy
400	ParameterIllegal.Protocol	ParameterIllegal.Protocol
400	ParameterMissing.Protocol	ParameterMissing.Protocol
400	ParameterLengthIllegal.Name	ParameterLengthIllegal.Name	The length of the rule name is invalid.
400	ParameterIllegal.Name	ParameterIllegal.Name	The name of the entry is invalid.
400	ParameterLengthIllegal.Description	ParameterLengthIllegal.Description
400	ParameterIllegal.Description	ParameterIllegal.Description
400	ParameterIllegal.SourceCidrIp	ParameterIllegal.SourceCidrIp
400	ParameterMissing.SourceCidrIp	ParameterMissing.SourceCidrIp
400	ParameterIllegal.DestinationCidrIp	ParameterIllegal.DestinationCidrIp
400	ParameterMissing.DestinationCidrIp	ParameterMissing.DestinationCidrIp
400	QuotaExceed.NetworkAclEntry	Network acl entry is over limit.	The number of rules in the network ACL has reached the upper limit
400	InvalidNetworkAcl.NotFound	The special Network Acl is not found.	The network ACL is not found.
400	NetworkStatus.Modifying	The special Network Acl is in modifying.	The network ACL is being modified.
400	ResourceStatus.Error	The binding instance is in middle status.	The status of the instance is invalid.
400	NotSupport.NetworkAcl	Network acl is not support now.
400	IllegalParam.IngressAclEntryId	The specified IngressAclEntryId is invalid.	The specified IngressAclEntryId is invalid.
400	IllegalParam.EgressAclEntryId	The specified EgressAclEntryId is invalid.	The specified EgressAclEntryId is invalid.
400	OperationDenied.VpcIpv6NotEnabled	IPv6 has not been enabled for the VPC.	The error message returned because the VPC does not support IPv6 and the operation is denied.
400	IllegalParam.SourceCidrIp	Param SourceCidrIp is illegal.	Illegal parameters: Source CIDR
400	IllegalParam.Policy	Param Policy illegal.	Illegal parameter: Policy
400	IllegalParam.Protocol	Param Protocol illegal.	Illegal parameter: Protocol.
400	IllegalParam.DestinationCidrIp	Param DestinationCidrIp illegal.	Illegal parameter: destination CIDR.
400	IllegalParam.IpVersion	Param IpVersion illegal.	Illegal parameter: IpVersion
400	IllegalParam.PortRange	The specified port range is invalid.	The port range is invalid.
400	ResourceNotFound.PrefixList	The specified resource of prefixList is not found.	The prefix list does not exist.
400	OperationDenied.IpVersionInconsistencyWithPrefixList	The ip version of the prefix list %s you passed in is inconsistent with the actual ip version of the prefix list.	the ip version of the prefix list you passed in is inconsistent with the actual ip version of the prefix list.
400	OperationDenied.SystemPrefixList	The operation is not allowed because of SystemPrefixList.	You cannot manage the system prefix list.
400	IncorrectStatus.PrefixList	The status of prefixList is incorrect.	The prefix list is in an unstable state.
400	UnsupportedRegion.PrefixListEntry	The feature of prefixList entry is not supported in this region.
400	OperationDenied.NetworkAclAttachmentInMiddleStatus	The network ACL is being bound to or unbound from the switch.	The network ACL is being bound to or unbound from the switch.
500	InternalError	The request processing has failed due to some unknown error.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.