All Products
Search

This Product

    Cloud Firewall:DescribeControlPolicy

    Document Center

    Cloud Firewall:DescribeControlPolicy

    Last Updated:Jun 10, 2026

    Mengambil semua kebijakan kontrol akses.

    Deskripsi operasi

    Use this API to run paginated queries for access control policies.

    QPS limit

    The QPS limit for a single user is 10. Exceeding this limit throttles API calls, which can impact your business. Plan your calls accordingly.

    Coba sekarang

    Coba API ini di OpenAPI Explorer tanpa perlu penandatanganan manual. Panggilan yang berhasil akan secara otomatis menghasilkan contoh kode SDK sesuai dengan parameter Anda. Unduh kode tersebut dengan kredensial bawaan yang aman untuk penggunaan lokal.

    Test

    RAM authorization

    Tabel berikut menjelaskan otorisasi yang diperlukan untuk memanggil API ini. Anda dapat menentukannya dalam kebijakan Resource Access Management (RAM). Kolom pada tabel dijelaskan sebagai berikut:

    • Action: Aksi yang dapat digunakan dalam elemen Action pada pernyataan kebijakan izin RAM untuk memberikan izin guna melakukan operasi tersebut.

    • API: API yang dapat Anda panggil untuk melakukan aksi tersebut.

    • Access level: Tingkat akses yang telah ditentukan untuk setiap API. Nilai yang valid: create, list, get, update, dan delete.

    • Resource type: Jenis resource yang mendukung otorisasi untuk melakukan aksi tersebut. Ini menunjukkan apakah aksi tersebut mendukung izin tingkat resource. Resource yang ditentukan harus kompatibel dengan aksi tersebut. Jika tidak, kebijakan tersebut tidak akan berlaku.

      • Untuk API dengan izin tingkat resource, jenis resource yang diperlukan ditandai dengan tanda bintang (*). Tentukan Nama Sumber Daya Alibaba Cloud (ARN) yang sesuai dalam elemen Resource pada kebijakan.

      • Untuk API tanpa izin tingkat resource, ditampilkan sebagai All Resources. Gunakan tanda bintang (*) dalam elemen Resource pada kebijakan.

    • Condition key: Kunci kondisi yang didefinisikan oleh layanan. Kunci ini memungkinkan kontrol granular, berlaku baik hanya untuk aksi maupun untuk aksi yang terkait dengan resource tertentu. Selain kunci kondisi spesifik layanan, Alibaba Cloud menyediakan serangkaian common condition keys yang berlaku di semua layanan yang didukung RAM.

    • Dependent action: Aksi dependen yang diperlukan untuk menjalankan aksi tersebut. Untuk menyelesaikan aksi tersebut, pengguna RAM atau role RAM harus memiliki izin untuk melakukan semua aksi dependen.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    yundun-cloudfirewall:DescribeControlPolicy

    get

    *ControlPolicyOrder

    acs:cloudfirewall::{#accountId}:controlpolicy/{#AclUuid}/controlpolicyorder/{#Direction}

    *ControlPolicy

    acs:cloudfirewall::{#accountId}:controlpolicy/{#AclUuid}

    		 None None

    Parameter permintaan

    Parameter

    Type

    Required

    Description

    Example
    Lang

    string

    No

    Bahasa tanggapan. Nilai valid:

    • zh (default): Cina

    • en: Inggris.

    zh
    Lang

    string

    No

    The language of the response. Valid values:

    • zh (default): Chinese

    • en: English

    zh
    Direction

    string

    No

    Arah trafik yang diterapkan oleh kebijakan kontrol akses. Nilai valid:

    • in: arah masuk

    • out: arah keluar.

    Valid values:

    • in :

      Kontrol akses untuk lalu lintas masuk.

    • out :

      Kontrol akses untuk lalu lintas keluar.

    in
    CurrentPage

    string

    Yes

    Nomor halaman yang akan dikembalikan.

    Nilai default: 1.

    1
    PageSize

    string

    Yes

    Jumlah entri yang dikembalikan per halaman.

    10
    Source

    string

    No

    Alamat sumber dalam kebijakan kontrol akses. Pencarian fuzzy didukung. Nilainya bergantung pada parameter SourceType.

    • Jika SourceType adalah net, nilainya adalah Blok CIDR. Contoh: 192.0.XX.XX/24.

    • Jika SourceType adalah group, nilainya adalah nama Buku alamat. Contoh: db_group.

    • Jika SourceType adalah location, nilainya adalah nama lokasi dalam bahasa Cina atau Inggris. Contoh: beijing.

    Catatan

    Jika tidak ditentukan, kebijakan tidak difilter berdasarkan sumber.

    192.0.XX.XX
    Destination

    string

    No

    Alamat tujuan dalam kebijakan kontrol akses. Pencarian fuzzy didukung. Nilainya bergantung pada parameter DestinationType.

    • Jika DestinationType adalah net, nilainya adalah Blok CIDR. Contoh: 10.0.3.0/24.

    • Jika DestinationType adalah domain, nilainya adalah Nama domain. Contoh: aliyun.

    • Jika DestinationType adalah group, nilainya adalah nama Buku alamat. Contoh: db_group.

    • Jika DestinationType adalah location, nilainya adalah kode lokasi. Untuk informasi selengkapnya tentang kode lokasi, lihat AddControlPolicy. Contoh: ["BJ11", "ZB"].

    Catatan

    Jika tidak ditentukan, kebijakan tidak difilter berdasarkan tujuan.

    192.0.XX.XX
    Description

    string

    No

    Deskripsi kebijakan. Pencarian fuzzy didukung.

    Catatan

    Jika tidak ditentukan, kebijakan tidak difilter berdasarkan deskripsi.

    test
    Proto

    string

    No

    Jenis protokol trafik. Nilai valid:

    • TCP

    • UDP

    • ICMP

    • ANY (semua jenis protokol)

    Catatan

    Jika tidak ditentukan, kebijakan tidak difilter berdasarkan jenis protokol.

    TCP
    AclAction

    string

    No

    Aksi yang diambil Cloud Firewall pada trafik yang cocok dengan kebijakan. Nilai valid:

    • accept: Mengizinkan trafik.

    • drop: Membuang trafik.

    • log: Mencatat trafik tanpa memblokirnya.

    Catatan

    Jika tidak ditentukan, kebijakan tidak difilter berdasarkan aksi.

    accept
    Release

    string

    No

    Apakah kebijakan diaktifkan. Nilai valid:

    • true: Kebijakan diaktifkan.

    • false: Kebijakan dinonaktifkan.

    true
    AclUuid

    string

    No

    Pengidentifikasi unik kebijakan.

    00281255-d220-4db1-8f4f-c4df221a****
    IpVersion

    string

    No

    Versi IP alamat dalam kebijakan. Nilai valid:

    • 4 (default): IPv4

    • 6: IPv6.

    Valid values:

    • 4 :

      IPv4.

    • 6 :

      IPv6.

    6
    RepeatType

    string

    No

    Jenis pengulangan untuk periode aktif kebijakan. Nilai valid:

    • Permanent (default): Selalu

    • None: Satu kali

    • Daily: Harian

    • Weekly: Mingguan

    • Monthly: Bulanan.

    Valid values:

    • Daily :

      Harian.

    • Monthly :

      Bulanan.

    • Permanent :

      Selalu.

    • Weekly :

      Mingguan.

    • None :

      Satu kali.

    Permanent

    Elemen respons

    Element

    Type

    Description

    Example

    object

    PageNo

    string

    The page number.

    1
    PageSize

    string

    The number of entries to return per page.

    10
    RequestId

    string

    The request ID.

    CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2****
    TotalCount

    string

    The total number of access control policies.

    100
    Policys

    array<object>

    The details of the access control policies.

    object

    N/A

    Direction

    string

    The traffic direction of the access control policy. Valid values:

    • in: inbound traffic

    • out: outbound traffic

    in
    Order

    integer

    The priority of the access control policy.

    Priorities start from 1. A smaller value indicates a higher priority.

    1
    SourceType

    string

    The type of the source address in the access control policy. Valid values:

    • net: a source CIDR block

    • group: a source address book

    • location: a source region

    net
    ApplicationName

    string

    The application type that the access control policy supports. We recommend that you use the ApplicationNameList parameter. Valid values:

    • FTP

    • HTTP

    • HTTPS

    • Memcache

    • MongoDB

    • MQTT

    • MySQL

    • RDP

    • Redis

    • SMTP

    • SMTPS

    • SSH

    • SSL

    • VNC

    • ANY (indicates all application types)

    HTTP
    HitTimes

    integer

    The hit count of the access control policy.

    100
    Description

    string

    The description of the access control policy.

    test
    SourceGroupType

    string

    The type of the source address book in the access control policy. Valid values:

    • ip: an IP address book that contains one or more CIDR blocks.

    • tag: an ECS tag address book that contains the IP addresses of ECS instances with one or more tags.

    • domain: a domain address book that contains one or more domain names.

    • threat: a threat address book that contains one or more malicious IP addresses or domain names.

    • backsrc: a back-to-source address book that contains the back-to-source IP addresses of one or more DDoS Protection or WAF instances.

    ip
    DnsResultTime

    integer

    The timestamp of the DNS resolution. This value is a UNIX timestamp in seconds.

    1579261141
    DnsResult deprecated

    string

    The DNS resolution result.

    192.0.XX.XX,192.0.XX.XX
    Proto

    string

    The protocol of the traffic to which the access control policy applies. Valid values:

    • ANY

    • TCP

    • UDP

    • ICMP

    TCP
    DestinationGroupType

    string

    The type of the destination address book in the access control policy. Valid values:

    • ip: an IP address book that contains one or more CIDR blocks.

    • tag: an ECS tag address book that contains the IP addresses of ECS instances with one or more tags.

    • domain: a domain address book that contains one or more domain names.

    • threat: a threat address book that contains one or more malicious IP addresses or domain names.

    • backsrc: a back-to-source address book that contains the back-to-source IP addresses of one or more DDoS Protection or WAF instances.

    ip
    Destination

    string

    The destination address in the access control policy. The value of this parameter varies based on the value of DestinationType.

    • If DestinationType is net, the value is a CIDR block. Example: 192.0.XX.XX/24.

    • If DestinationType is domain, the value is a domain name. Example: aliyuncs.com.

    • If DestinationType is group, the value is the name of an address book. Example: db_group.

    • If DestinationType is location, the value is a location name. For more information about location codes, see AddControlPolicy. Example: ["BJ11", "ZB"].

    192.0.XX.XX/24
    HitLastTime

    integer

    The timestamp of the last hit. This value is a UNIX timestamp in seconds.

    1579261141
    DestPortGroup

    string

    The name of the destination port address book.

    my_port_group
    AclUuid

    string

    The unique ID of the access control policy.

    00281255-d220-4db1-8f4f-c4df221a****
    DestPortType

    string

    The type of the destination port in the access control policy. Valid values:

    • port: port

    • group: port address book

    port
    Source

    string

    The source address in the access control policy.

    • If SourceType is net, the value is a CIDR block. Example: 192.0.XX.XX/24.

    • If SourceType is group, the value is the name of a source address book. Example: db_group.

    • If SourceType is location, the value is a location. For more information about location codes, see AddControlPolicy. Example: ["BJ11", "ZB"].

    192.0.XX.XX/24
    DestinationType

    string

    The type of the destination address in the access control policy. Valid values:

    • net: a destination CIDR block

    • group: a destination address book

    • domain: a destination domain name

    • location: a destination region

    net
    DestPort

    string

    The destination port of the traffic to which the access control policy applies.

    80
    IpVersion

    integer

    The IP version supported by the access control policy. Valid values:

    • 4: IPv4

    • 6: IPv6

    6
    AclAction

    string

    The action to take on traffic that matches the access control policy. Valid values:

    • accept: allows the traffic.

    • drop: denies the traffic.

    • log: monitors the traffic.

    accept
    Release

    string

    The enabled status of the access control policy. An access control policy is enabled by default after it is created. Valid values:

    • true: The access control policy is enabled.

    • false: The access control policy is disabled.

    true
    ApplicationId

    string

    The ID of the application to which the policy applies.

    10***
    DestinationGroupCidrs

    array

    The CIDR blocks in the destination address book.

    string

    A CIDR block in the destination address book.

    192.0.XX.XX/24
    DestPortGroupPorts

    array

    The ports in the destination port address book.

    string

    A port in the destination port address book.

    80/80
    SourceGroupCidrs

    array

    The CIDR blocks in the source address book.

    string

    A CIDR block in the source address book.

    192.0.XX.XX/24
    ApplicationNameList

    array

    The application names.

    string

    An application type that the access control policy supports. Valid values:

    • FTP

    • HTTP

    • HTTPS

    • Memcache

    • MongoDB

    • MQTT

    • MySQL

    • RDP

    • Redis

    • SMTP

    • SMTPS

    • SSH

    • SSL

    • VNC

    • ANY (indicates all application types)

    HTTP
    SpreadCnt

    integer

    The specification count consumed by the access control policy. The specification count of a single policy is calculated by using the following formula: Number of source addresses (number of CIDR blocks or regions) × Number of destination addresses (number of CIDR blocks, regions, or domains) × Number of port ranges × Number of applications.

    10000
    CreateTime

    integer

    The time when the policy was created. This value is a UNIX timestamp in seconds, representing the number of seconds that have elapsed since January 1, 1970 (UTC).

    1761062400
    ModifyTime

    integer

    The time when the policy was last modified. This value is a UNIX timestamp in seconds, representing the number of seconds that have elapsed since January 1, 1970 (UTC).

    1761062400
    RepeatType

    string

    The recurrence type for the policy validity period. Valid values:

    • Permanent (default): Always

    • None: One-time

    • Daily: Daily

    • Weekly: Weekly

    • Monthly: Monthly

    Valid values:

    • Daily :

      Daily

    • Monthly :

      Monthly

    • Permanent :

      Always

    • Weekly :

      Weekly

    • None :

      One-time

    Permanent
    RepeatDays

    array

    The days of the week or month on which the policy recurs.

    • If RepeatType is Permanent, None, or Daily, this parameter is empty. Example: [].

    • If RepeatType is Weekly, this parameter cannot be empty. Example: [0, 6].

    Catatan

    If RepeatType is Weekly, values in this array cannot be duplicates.

    • If RepeatType is Monthly, this parameter cannot be empty. Example: [1, 31].

    Catatan

    If RepeatType is Monthly, values in this array cannot be duplicates.

    integer

    The recurring day for the policy validity period.

    Catatan

    If RepeatType is set to Weekly, the value is a number from 0 (Sunday) to 6 (Saturday). If RepeatType is set to Monthly, the value is a number from 1 to 31.

    1
    RepeatStartTime

    string

    The recurrence start time, in HH:mm format (for example, 08:00). The time must be on the hour or half-hour and at least 30 minutes before the recurrence end time.

    Catatan

    This parameter is required only when RepeatType is Daily, Weekly, or Monthly.

    08:00
    RepeatEndTime

    string

    The recurrence end time, in HH:mm format (for example, 23:30). The time must be on the hour or half-hour and at least 30 minutes after the recurrence start time.

    Catatan

    This parameter is required only when RepeatType is Daily, Weekly, or Monthly.

    23:30
    StartTime

    integer

    The start time of the policy validity period, as a UNIX timestamp in seconds. The time must be on the hour or half-hour and at least 30 minutes before the end time.

    Catatan

    This parameter is required if RepeatType is not Permanent.

    1694761200
    EndTime

    integer

    The end time of the policy validity period, as a UNIX timestamp in seconds. The time must be on the hour or half-hour and at least 30 minutes after the start time.

    Catatan

    This parameter is required if RepeatType is not Permanent.

    1694764800
    DomainResolveType

    string

    The domain name resolution method for the access control policy. Valid values:

    • FQDN: FQDN-based resolution

    • DNS: Dynamic DNS resolution

    • FQDN_AND_DNS: FQDN-based and dynamic DNS resolution

    FQDN

    Contoh

    Respons sukses

    JSONformat

    {
  "PageNo": "1",
  "PageSize": "10",
  "RequestId": "CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2****",
  "TotalCount": "100",
  "Policys": [
    {
      "Direction": "in",
      "Order": 1,
      "SourceType": "net",
      "ApplicationName": "HTTP",
      "HitTimes": 100,
      "Description": "test",
      "SourceGroupType": "ip",
      "DnsResultTime": 1579261141,
      "DnsResult": "192.0.XX.XX,192.0.XX.XX",
      "Proto": "TCP",
      "DestinationGroupType": "ip",
      "Destination": "192.0.XX.XX/24",
      "HitLastTime": 1579261141,
      "DestPortGroup": "my_port_group",
      "AclUuid": "00281255-d220-4db1-8f4f-c4df221a****",
      "DestPortType": "port",
      "Source": "192.0.XX.XX/24",
      "DestinationType": "net",
      "DestPort": "80",
      "IpVersion": 6,
      "AclAction": "accept",
      "Release": "true",
      "ApplicationId": "10***",
      "DestinationGroupCidrs": [
        "192.0.XX.XX/24"
      ],
      "DestPortGroupPorts": [
        "80/80"
      ],
      "SourceGroupCidrs": [
        "192.0.XX.XX/24"
      ],
      "ApplicationNameList": [
        "HTTP"
      ],
      "SpreadCnt": 10000,
      "CreateTime": 1761062400,
      "ModifyTime": 1761062400,
      "RepeatType": "Permanent",
      "RepeatDays": [
        1
      ],
      "RepeatStartTime": "08:00",
      "RepeatEndTime": "23:30",
      "StartTime": 1694761200,
      "EndTime": 1694764800,
      "DomainResolveType": "FQDN"
    }
  ]
}

    Kode kesalahan

    HTTP status code

    Error code

    Error message

    Description
    400 ErrorParametersUid The aliUid parameter is invalid.
    400 ErrorParametersPageSizeOrNo Either pageSize or pageNo is invalid.
    400 ErrorParameterIpVersion The IP version is invalid.
    400 ErrorParametersDirection The direction is invalid.
    400 ErrorDBSelect An error occurred while querying database.
    400 ErrorUnmarshalJSON An error occurred while parsing JSON.
    400 ErrorUUIDNew The UUID is invalid.
    400 ErrorParametersAppId The AppId parameter is incorrect.
    400 ErrorParametersSource The source is invalid.
    400 ErrorDomainResolve An error occurred while resolving the domain.
    400 ErrorParametersDestination The Destination parameter is invalid.
    400 ErrorParametersProto The protocol is invalid.
    400 ErrorParametersDestPort The dst_port is invalid.
    400 ErrorParametersAction The action is invalid.
    400 ErrorParameters Parameters error.
    400 ErrorMarshalJSON An error occurred while encoding JSON.
    400 ErrorParametersAclUuid Specified parameter AclUuid is not valid.

    Lihat Error Codes untuk daftar lengkap.

    Catatan rilis

    Lihat Release Notes untuk daftar lengkap.