Automate WAF Certificate Rotation with ModifyCloudResourceCert - Web Application Firewall - Alibaba Cloud - Web Application Firewall

Modifies the certificate for a cloud native mode resource.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-waf:ModifyCloudResourceCert

none

*All Resource

*

None

Request syntax

POST  HTTP/1.1

Request parameters

Parameter	Type	Required	Description	Example
InstanceId	string	Yes	Instance ID of the WAF instance. Note You can call the DescribeInstance operation to query instance ID of the WAF instance.	waf_v2_public_cn-***
ResourceProduct `deprecated`	string	No	The cloud service type. Valid values: ecs : ECS. clb4 : Layer 4 CLB. nlb : NLB.	clb4
ResourceInstanceId `deprecated`	string	No	The ID of the cloud service instance.	lb-bp1*****jqnnqk5uj2p
Port `deprecated`	integer	No	The port of the cloud service that is connected to WAF.	443
Certificates	array<object>	Yes	The list of certificates. Note Specify all certificate IDs, including the default certificate ID and all extension certificate IDs. After submission, WAF compares the submitted certificate IDs with the existing ones. Certificates that are newly added are created, and certificates that are missing are deleted. Deleting a certificate ID may affect related services.
	object	Yes	The list of certificates.
CertificateId	string	Yes	The certificate ID.	232***-cn-hangzhou
AppliedType	string	Yes	The certificate type for the HTTPS protocol. Valid values: default : default certificate. extension : extension certificate.	default
RegionId	string	Yes	The region where the WAF instance resides. Valid values: cn-hangzhou: the Chinese mainland. ap-southeast-1: outside the Chinese mainland.	cn-hangzhou
CloudResourceId	string	No	The ID of the connected resource, which is automatically generated by WAF during cloud native mode connection. Note You can call the CreateCloudResource operation to connect a resource and then view the resource ID in the response.	lb-bp*********k5uj2p-443-clb7

Response elements

Element	Type	Description	Example
	object	Schema of Response
RequestId	string	Id of the request	A47D2DC0-7151-51EF-BFB7-***

Examples

Success response

JSON format

{
  "RequestId": "A47D2DC0-7151-51EF-BFB7-***"
}

Error codes

HTTP status code	Error code	Error message	Description
400	Waf.Pullin.CertNotExist	Certificate does not exist in SSL Certificate Center, certificate type:%s, certificate ID:%s.	Certificate does not exist in SSL Certificate Center, certificate type:%s, certificate ID:%s.
400	Waf.Pullin.OnlyBeOneDefaultCert	There can be only one default certificate.	There can be only one default certificate.
400	Waf.Pullin.MaxCertCountLimit	The number of selected certificate IDs exceeds the maximum number in the system.	The number of selected certificate IDs exceeds the maximum number in the system.
400	Waf.Pullin.CertExpired	Certificate expired, certificate ID:%s .	Certificate expired, certificate ID:%s.
400	Waf.Pullin.CloudResourceInvalid	CloudResourceId parameter is illegal.	CloudResourceId parameter is illegal
400	Waf.Pullin.CloudProductParamEmpty	The resource Id of the cloud product accessing WAF is null or null values exist in the three input parameters of the cloud product name, port, and cloud product instance.	The resource Id of the cloud product accessing WAF is null or null values exist in the three input parameters of the cloud product name, port, and cloud product instance.
400	Waf.Pullin.CloudProductParamNotMatch	The value of the cloud product, port, instance, and input parameter to which the resource ID of the cloud product is connected to WAF does not match.	The value of the cloud product, port, instance, and input parameter to which the resource ID of the cloud product is connected to WAF does not match.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.