Virtual Private Cloud:Prefix lists

Create a prefix list

1. Go to the VPC console - Prefix List page. In the top-left corner of the menu bar, select a Region and click Create Prefix List.

2. In the Create Prefix List panel:

   1. IP Version: Select IPv4 or IPv6.

   2. Maximum Entries: Set the maximum number of entries. This value consumes quotas in VPC route tables and security groups. You can modify this value after creation. For example, if a prefix list contains only 20 entries, it still consumes a quota of 50 routes in a VPC route table or 50 rules in a security group if the maximum number of entries is set to 50.

      The default quota for custom routes in a VPC route table is 200. The default quota for rules in a security group is 200.

   3. Prefix List Entries: Choose Entry-By-Entry Import, Batch Import, or Clone From Another List. You can clone entries across regions, but not from shared or system prefix lists.

Add or delete entries

On the Entry tab of the prefix list:

• Add an entry: Click Create Prefix List.

• Delete an entry: Click Delete in the Actions column, or select multiple entries, and click Delete in Batches.

View referencing resources

On the details page for the target prefix list, click the Association tab.

Delete a prefix list

On the details page of the prefix list, click Delete in the Actions column.

Before deletion, make sure that it is not referenced by other resources or being shared.

Enable sharing

The following steps describe how to share a prefix list with any account. To share resources only within a resource directory, see Share resources only within a resource directory.

1. Log on to the Resource Management console using the owner account and go to the Resource Sharing - Resources I Share page. From the menu bar in the top-left corner, select the region where the shared resource is located, and click Create Resource Share. On the page that opens:

   1. Step 1: Enter a Resource Share Name. In the Resources panel, select VPC Prefix List from the drop-down list. Then, select the prefix lists to share.

   2. Step 2: The AliyunRSDefaultPermissionPrefixList permission is selected by default.

   3. Step 3: Set Principal Scope to All Accounts and Method to Add Manually. Enter the Alibaba Cloud account ID of the prefix list principal, and then click Add.

   4. Step 4: Verify the settings and click OK at the bottom of the page.

2. Log on to the Alibaba Cloud console using the principal account and accept the sharing invitation:

   1. Go to the Resource Sharing - Resources Shared To Me page.

   2. In the top-left corner of the menu bar, select the region of the shared resource, and click Accept in the Status column for the target resource share.

   3. After accepting the invitation, you can access the shared prefix list. Invitations for subsequent shared resources added to this resource share are accepted by default.

   4. Go to the VPC prefix list page in the VPC console. From the menu bar, select the target region to view the received prefix lists. For received prefix lists, the Owner column is marked as Shared.

      

   5. Next, you can reference the prefix list in a VPC route table, TR route table, or ECS security group. For more information, see Reference a prefix list.

Manage shared prefix lists and principals

The prefix list owner can follow these steps to view, add, or delete shared prefix lists and their principals.

1. Log on to the Alibaba Cloud console using the account of the prefix list owner. Go to the Resource Sharing - Resources I Share page in the Resource Management console. In the top navigation bar, select the region where the shared prefix list is located.

2. On the Shared By Me page, you can:

   • View shared prefix lists: Click the Shared Resources tab.

   • View principals: Click the Principals tab.

3. On the Resource Shares tab, find the target resource share and click its ID.

4. Click the Resources or Principals tab to view the prefix lists and principals associated with this resource share.

   On the Resources and Principals tabs, if the Status is Associated, it indicates the shared resource and the principal are successfully associated:

   

   Common reasons for association failure

   If the Status under the Resources and Principals tabs is Association Failed, the sharing operation failed. Troubleshoot the issue by checking for the following possible causes before adding the prefix again:

   • The principal accountis the same as the owner account. An owner cannot share a prefix list with themselves.

   • The prefix list principals have exceeded the quota. The default quota is 10.

   • The shared prefix lists that a principal can receive has exceeded the quota. The default quota is 100.

5. On the target resource share page, click Edit Resource Share in the upper-right corner. On the page that appears, you can:

   • Add or remove shared prefix lists: In Step 1, you can select or deselect prefix lists.

   • Add or remove principals from a shared prefix list: In Step 3, you can add or remove account UIDs.

6. On the Edit Resource Share page, in Step 4, confirm your settings and click OK.

Enable sharing

• Method 1: Share with any account

  1. Using the identity credentials of the prefix list owner, call CreateResourceShare to create a resource share. Set the AllowExternalTargets parameter to True.

  2. Using the identity credentials of the prefix list principal, first call ListResourceShareInvitations to query the sharing invitations. Then, call AcceptResourceShareInvitation to accept the invitation.

• Method 2: Share only within a resource directory

  Before you begin, ensure that the prefix list owner and principal are in the same resource directory.

  1. Using the identity credentials of the management account of the resource directory, call EnableSharingWithResourceDirectory to enable sharing within the resource directory.

  2. Using the identity credentials of the prefix list owner, call CreateResourceShare to create a resource share. Set the AllowExternalTargets parameter to False.

Manage shared prefix lists and principals

The prefix list owner can view the shared prefix lists and principals:

• Call ListSharedResources to view shared prefix lists.

• Call ListSharedTargets to view the list of principals for a shared prefix list.

The prefix list owner can manage shared prefix lists and principals within a resource share:

• Call ListResourceShareAssociations to view the prefix lists or principals within a resource share.

• Call AssociateResourceShare to add a shared prefix list or principal to a resource share.

• Call DisassociateResourceShare to remove a shared prefix list or principal from a resource share.

Terraform currently does not support sharing prefix lists with any account. It only supports sharing within a resource directory. Before you begin, make sure the management account of the resource directory has enabled sharing within the resource directory.

Resources: alicloud_resource_manager_resource_share, alicloud_resource_manager_shared_resource, alicloud_resource_manager_shared_target

Enable sharing using the owner identity credentials:

# Specify the region
provider "alicloud" {
  region = "cn-hangzhou"
}

# Specify the resource share name
resource "alicloud_resource_manager_resource_share" "example_unit" {
  resource_share_name = "example_unit_name"
}

# Specify the shared prefix list
resource "alicloud_resource_manager_shared_resource" "example_vsw" {
  resource_share_id = alicloud_resource_manager_resource_share.example_unit.id
  resource_id       = "pl-bp18t4lsc3e4yd6xxxxx" # ID of the prefix list to share
  resource_type     = "PrefixList"               # The resource type is PrefixList 
}

# Specify the principal of the shared prefix list
resource "alicloud_resource_manager_shared_target" "example_target" {
  resource_share_id = alicloud_resource_manager_resource_share.example_unit.id
  target_id         = "101xxxxxxxxxxxxxxx" # UID of the prefix list principal
}