Virtual Private Cloud:Prefix lists

Create a prefix list

1. Go to the VPC Prefix List page in the VPC console. Select a region in the top navigation bar, and then click Create Prefix List.

2. In the Create Prefix List panel, configure the following parameters:

   1. Select an IP Version (IPv4/IPv6).

   2. Set the Maximum Entries. This value determines quota consumption in VPC route tables and security groups. You can modify it after creation.

      For example, a prefix list with a maximum of 50 entries consumes 50 route entries or 50 security group rules in quota, even if only 20 entries exist.

      Quota reference: By default, a VPC route table supports up to 200 custom route entries, and a security group supports up to 200 rules.

   3. Configure Prefix List Entries. You can use one of the following methods: Manual Input, Batch Import, or Clone from Another List. You can clone entries from a prefix list in another region, but not from a shared or system prefix list.

Add or delete entries

On the details page of the prefix list, go to the Entry tab:

• To add entries, click Create Prefix List.

• To delete entries, click Delete in the Actions column of an entry, or select multiple entries and click Delete in Batches.

View referencing resources

On the details page of the prefix list, click the Association tab to view all resources that reference it.

Delete a prefix list

To delete a prefix list, find it in the list and click Delete in the Actions column. You can also click Delete on the details page.

Before you delete a prefix list, make sure that it is not referenced by any resources or shared with other accounts.

Enable sharing

This section describes how to share a prefix list with any account. To share resources only within a resource directory, see Share resources only within a resource directory.

1. Log on to the Resource Management console with the owner account and go to the Resource Sharing > Shared by Me page. Select the region of the resource that you want to share from the top navigation bar, and then click Create Resource Share. Perform the following steps:

   1. Step 1: Enter a Resource Share Name. In the Resources section, select VPC Prefix List from the drop-down list, and then select the prefix lists that you want to share.

   2. Step 2: The system selects the AliyunRSDefaultPermissionPrefixList permission by default.

   3. Step 3: Set Principal Scope to All Accounts and Method to Add Manually. Enter the Alibaba Cloud account ID of the principal, and then click Add.

   4. Step 4: Review the configurations and click Confirm.

2. Log on to the Alibaba Cloud console as the principal and accept the sharing invitation:

   1. Go to the Resource Sharing > Shared with Me page in the Resource Management console.

   2. In the top navigation bar, select the region of the shared resource, find the target resource share, and click Accept in the Status column.

   3. After you accept the invitation, you can access the shared prefix list. Invitations for new resources added to this resource share are accepted by default.

   4. Go to the VPC Prefix List page in the VPC console. Select the region of the shared prefix list in the top navigation bar. You can view the received prefix lists. The Owner column is displayed as Shared.

   5. You can now reference the shared prefix list in your VPC route tables, TR route tables, and ECS security groups. Reference a prefix list.

Manage shared prefix lists and principals

The prefix list owner can view, add, or remove shared prefix lists and principals:

1. Log on to the Resource Management console with the owner account and go to the Resource Sharing > Shared by Me page. In the top navigation bar, select the region where the shared prefix list is located.

2. On the Resources I Share page, you can perform the following actions:

   • View shared prefix lists: Click the Shared Resources tab.

   • View principals of a shared prefix list: Click the Principals tab.

3. Click the Resource Shares tab, find the target resource share, and click its ID.

4. Click the Resources or Principals tab to view the shared prefix lists and principals within this resource share.

   If the Status on the Resources and Principals tabs is Associated, the resource and principal are successfully associated.

   Common reasons for association failure

   If the Status in the Resources or Principals section is Association Failed, the sharing failed. Troubleshoot the issue and try again.

   • The principal account is the same as the owner account. You cannot share a prefix list with yourself.

   • The number of principals with which a prefix list can be shared has reached the quota. The default quota is 10.

   • The number of shared prefix lists that a principal can accept has reached the quota. The default quota is 100.

5. On the details page of the resource share, click Edit Resource Share in the upper-right corner. You can perform the following actions within this resource share:

   • Add or remove shared prefix lists: In Step 1, select or clear the check boxes of the prefix lists.

   • Add or remove principals: In Step 3, add or remove account IDs.

6. After you review the configurations, in Step 4 of the Edit Resource Share page, click Confirm.

Enable sharing

• Method 1: Share with any account

  1. Use the credentials of the prefix list owner to call CreateResourceShare to create a resource share. Make sure that the AllowExternalTargets parameter is set to True.

  2. Use the credentials of the prefix list principal to call ListResourceShareInvitations to query received resource invitations, and then call AcceptResourceShareInvitation to accept a resource sharing invitation.

• Method 2: Share only within a resource directory

  Before you begin, make sure that the prefix list owner and principal are members of the same resource directory.

  1. Use the credentials of the management account of the resource directory to call EnableSharingWithResourceDirectory to enable resource sharing within the resource directory.

  2. Use the credentials of the prefix list owner to call CreateResourceShare to create a resource share. Make sure that the AllowExternalTargets parameter is set to False.

Manage shared prefix lists and principals

As the prefix list owner, call the following operations to view shared prefix lists and principals:

• Call ListSharedResources to view shared prefix lists.

• Call ListSharedTargets to view the principals of shared prefix lists.

As the prefix list owner, call the following operations to manage shared prefix lists and principals within a resource share:

• Call ListResourceShareAssociations to view the prefix lists or principals in a resource share.

• Call AssociateResourceShare to add a shared prefix list or principal to a resource share.

• Call DisassociateResourceShare to remove a shared prefix list or principal from a resource share.

Terraform supports sharing prefix lists only within a resource directory, not with any account. Before you begin, make sure that the management account of the resource directory has enabled sharing for the resource directory.

Resources: alicloud_resource_manager_resource_share, alicloud_resource_manager_shared_resource, alicloud_resource_manager_shared_target

Use the credentials of the prefix list owner to enable sharing:

# Specify the region.
provider "alicloud" {
  region = "cn-hangzhou"
}

# Specify the name of the resource share.
resource "alicloud_resource_manager_resource_share" "example_unit" {
  resource_share_name = "example_unit_name"
}

# Specify the prefix list to be shared.
resource "alicloud_resource_manager_shared_resource" "example_vsw" {
  resource_share_id = alicloud_resource_manager_resource_share.example_unit.id
  resource_id       = "pl-bp18t4lsc3e4yd6xxxxx" # The ID of the prefix list to be shared.
  resource_type     = "PrefixList"               # The resource type is PrefixList. 
}

# Specify the principal of the shared prefix list.
resource "alicloud_resource_manager_shared_target" "example_target" {
  resource_share_id = alicloud_resource_manager_resource_share.example_unit.id
  target_id         = "101xxxxxxxxxxxxxxx" # The UID of the prefix list principal.
}