DescribeVpcFirewallControlPolicy-阿里云帮助中心

Retrieves all access control policies for a specific VPC boundary firewall.

Operation description

This operation queries the access control policies for a VPC firewall. A VPC firewall uses different access control policies to protect traffic between two VPCs that are connected via Cloud Enterprise Network (CEN) or Express Connect.

QPS limit

The QPS limit for this operation is 10 requests per second per account. If you exceed this limit, your API calls are throttled.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-cloudfirewall:DescribeVpcFirewallControlPolicy

get

*VpcFirewallControlPolicy

acs:cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/{#AclUuid}

*VpcFirewall

acs:cloudfirewall::{#accountId}:vpcfirewall/{#VpcFirewallId}

None

Request parameters

Parameter	Type	Required	Description	Example
Lang	string	No	The language of the request and response. Valid values: zh (default): Chinese en: English	zh
VpcFirewallId	string	Yes	The instance ID of the VPC boundary firewall. You can specify one of the following IDs: The ID of a Cloud Enterprise Network (CEN) instance if the firewall protects traffic between two VPCs connected via the CEN instance. The instance ID of the VPC boundary firewall if the firewall protects traffic between two VPCs connected via an Express Connect circuit. Note You can call the DescribeVpcFirewallList operation to obtain the ID.	vfw-a42bbb7b887148c9****
CurrentPage	string	No	The page number.	1
PageSize	string	No	The number of entries per page. Maximum value: 50.	10
Source	string	No	The source address in the access control policy. Fuzzy match is supported. Note The value can be a CIDR block or an address book.	192.0.XX.XX/24
Destination	string	No	The destination address in the access control policy. Fuzzy match is supported. Note The value can be a CIDR block, a domain name, or an address book.	192.0.XX.XX/24
Description	string	No	The description of the access control policy. Fuzzy match is supported.	test
Proto	string	No	The protocol type in the access control policy. Valid values: TCP UDP ICMP ANY: all protocols Note If you do not set this parameter, policies of all protocols are queried.	TCP
AclAction	string	No	The action that is performed on traffic. Valid values: accept: allows the traffic. drop: denies the traffic. log: monitors the traffic. Note If you do not set this parameter, policies of all actions are queried.	accept
MemberUid	string	No	The UID of the member that is managed by your Alibaba Cloud account.	258039427902****
AclUuid	string	No	The unique ID of the access control policy.	4037fbf7-3e39-4634-92a4-d0155247****
Release	string	No	The status of the access control policy. Valid values: true: enabled false: disabled	true
RepeatType	string	No	The recurrence type of the access control policy. Valid values: Permanent (default): The policy is always in effect. None: The policy is a one-time policy. Daily: The policy recurs daily. Weekly: The policy recurs weekly. Monthly: The policy recurs monthly. Valid values: Daily : Monthly : Permanent : Weekly : None :	Permanent

Response elements

Element	Type	Description	Example
	object
TotalCount	string	The total number of VPC firewall access control policies.	20
RequestId	string	The request ID.	CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D
Policys	array<object>	The VPC firewall access control policies.
	object
Destination	string	The destination address for the access control policy. The value depends on `DestinationType`. If `DestinationType` is `net`, the value is a destination CIDR block. If `DestinationType` is `domain`, the value is a destination domain name. If `DestinationType` is `group`, the value is the name of a destination address book.	192.0.XX.XX/24
Order	integer	The priority of the access control policy, starting from 1. A smaller value indicates a higher priority.	1
DestPortGroup	string	The name of the destination port address book.	my_port_group
SourceType	string	The type of the source address. Valid values: net: a source CIDR block group: a source address book	net
ApplicationName	string	The application type. We recommend that you use `ApplicationNameList` instead. Valid values: HTTP HTTPS MySQL SMTP SMTPS RDP VNC SSH Redis MQTT MongoDB Memcache SSL ANY (all application types)	HTTP
AclUuid	string	The unique identifier of the access control policy.	4037fbf7-3e39-4634-92a4-d0155247****
DestPortType	string	The type of the destination port. Valid values: port: a single port group: a port address book	port
Source	string	The source address for the access control policy. The value depends on `SourceType`. If `SourceType` is `net`, the value is a source CIDR block. If `SourceType` is `group`, the value is the name of a source address book.	192.0.XX.XX/24
DestinationType	string	The type of the destination address. Valid values: net: a destination CIDR block group: a destination address book domain: a destination domain name	net
HitTimes	integer	The number of policy hits.	100
DestPort	string	The destination port.	80
Description	string	The policy description.	test
AclAction	string	The action to perform on traffic that matches the access control policy. Valid values: accept: allows the traffic. drop: denies the traffic. log: logs the traffic.	accept
ApplicationId	string	The ID of the application.	10**
Proto	string	The protocol type. Valid values: TCP UDP ICMP ANY (all protocol types)	TCP
DestinationGroupCidrs	array	The CIDR blocks in the destination address book.
	string	A CIDR block in the destination address book.	["192.0.XX.XX/24", "192.0.XX.XX/32"]
DestPortGroupPorts	array	The ports in the destination port address book.
	string	A port in the destination port address book.	[80,443]
SourceGroupCidrs	array	The CIDR blocks in the source address book.
	string	A CIDR block in the source address book.	["192.0.XX.XX/24", "198.51.XX.XX/32"]
MemberUid	string	The UID of the member account.	258039427902****
Release	string	The enabled status of the access control policy. A policy is enabled by default after it is created. Valid values: true: The policy is enabled. false: The policy is disabled.	true
SourceGroupType	string	The type of the source address book. The value is always ip, which indicates an address book that contains IP addresses or CIDR blocks.	ip
DestinationGroupType	string	The type of the destination address book. Valid values: ip: an address book of IP addresses or CIDR blocks. domain: an address book of domain names.	ip
HitLastTime	integer	The UNIX timestamp, in seconds, of the last policy hit.	1579261141
ModifyTime	integer	The UNIX timestamp, in seconds, of when the policy was last modified.	1761062400
SpreadCnt	integer	The number of rule capacity units that the access control policy consumes. This is calculated as: Number of source addresses × Number of destination addresses × Number of applications × Number of port ranges.	10000
CreateTime	integer	The UNIX timestamp, in seconds, of when the policy was created.	1761062400
ApplicationNameList	array	The list of application names.
	string	An application type. Valid values: HTTP HTTPS MySQL SMTP SMTPS RDP VNC SSH Redis MQTT MongoDB Memcache SSL ANY (all application types)	[ "HTTPS", "SMTPS", "SSL" ]
RepeatType	string	The recurrence type for the policy's effective period. Valid values: Permanent (default): The policy is always active. None: The policy applies only once. Daily: The policy recurs daily. Weekly: The policy recurs weekly. Monthly: The policy recurs monthly. Valid values: Daily : Daily Monthly : Monthly Permanent : Always Weekly : Weekly None : One-time	Permanent
RepeatDays	array	The days of the week or month on which the policy recurs. If `RepeatType` is set to `Permanent`, `None`, or `Daily`, this parameter is empty. Example: `[]` If `RepeatType` is set to `Weekly`, this parameter is required. Example: `[0, 6]` Note If `RepeatType` is set to `Weekly`, do not specify duplicate values for this parameter. If `RepeatType` is set to `Monthly`, this parameter is required. Example: `[1, 31]` Note If `RepeatType` is set to `Monthly`, do not specify duplicate values for this parameter.
	integer	A day on which the policy recurs. Note Valid values are 0 (Sunday) to 6 for `Weekly` recurrence, and 1 to 31 for `Monthly` recurrence.	1
RepeatStartTime	string	The recurrence start time. The time is in the `HH:mm` 24-hour format, such as `08:00`. Note This parameter is not used if `RepeatType` is `Permanent` or `None`. It is required for `Daily`, `Weekly`, or `Monthly` recurrence.	08:00
RepeatEndTime	string	The recurrence end time. The time is in the `HH:mm` 24-hour format, such as `23:30`. Note This parameter is not used if `RepeatType` is `Permanent` or `None`. It is required for `Daily`, `Weekly`, or `Monthly` recurrence.	23:30
StartTime	integer	The UNIX timestamp, in seconds, for the start of the policy's effective period. The time must be on the hour or half-hour and at least 30 minutes before the end time. Note This parameter is not used if `RepeatType` is `Permanent`. It is required for `None`, `Daily`, `Weekly`, or `Monthly` recurrence.	1694761200
EndTime	integer	The UNIX timestamp, in seconds, for the end of the policy's effective period. The time must be on the hour or half-hour and at least 30 minutes after the start time. Note This parameter is not used if `RepeatType` is `Permanent`. It is required for `None`, `Daily`, `Weekly`, or `Monthly` recurrence.	1694764800
DomainResolveType	string	The domain name resolution mode. Valid values: FQDN: FQDN-based resolution DNS: DNS-based dynamic resolution FQDN_AND_DNS: FQDN-based and DNS-based dynamic resolution	FQDN

Examples

Success response

JSON format

{
  "TotalCount": "20",
  "RequestId": "CBF1E9B7-D6A0-4E9E-AD3E-2B47E6C2837D",
  "Policys": [
    {
      "Destination": "192.0.XX.XX/24",
      "Order": 1,
      "DestPortGroup": "my_port_group",
      "SourceType": "net",
      "ApplicationName": "HTTP",
      "AclUuid": "4037fbf7-3e39-4634-92a4-d0155247****",
      "DestPortType": "port",
      "Source": "192.0.XX.XX/24",
      "DestinationType": "net",
      "HitTimes": 100,
      "DestPort": "80",
      "Description": "test",
      "AclAction": "accept",
      "ApplicationId": "10**",
      "Proto": "TCP",
      "DestinationGroupCidrs": [
        "[\"192.0.XX.XX/24\", \"192.0.XX.XX/32\"]"
      ],
      "DestPortGroupPorts": [
        "[80,443]"
      ],
      "SourceGroupCidrs": [
        "[\"192.0.XX.XX/24\", \"198.51.XX.XX/32\"]"
      ],
      "MemberUid": "258039427902****",
      "Release": "true",
      "SourceGroupType": "ip",
      "DestinationGroupType": "ip",
      "HitLastTime": 1579261141,
      "ModifyTime": 1761062400,
      "SpreadCnt": 10000,
      "CreateTime": 1761062400,
      "ApplicationNameList": [
        "[\n    \"HTTPS\", \n    \"SMTPS\", \n    \"SSL\"\n]"
      ],
      "RepeatType": "Permanent",
      "RepeatDays": [
        1
      ],
      "RepeatStartTime": "08:00",
      "RepeatEndTime": "23:30",
      "StartTime": 1694761200,
      "EndTime": 1694764800,
      "DomainResolveType": "FQDN"
    }
  ]
}

Error codes

HTTP status code	Error code	Error message	Description
400	ErrorParametersUid	The aliUid parameter is invalid.	The aliUid parameter is invalid.
400	ErrorParametersPageSizeOrNo	Either pageSize or pageNo is invalid.	Either pageSize or pageNo is invalid.
400	ErrorDBSelect	An error occurred while querying database.	An error occurred while querying database.
400	ErrorUUIDNew	The UUID is invalid.	The UUID is invalid.
400	ErrorParametersAppId	The appId is invalid.	The appId is invalid.
400	ErrorParameterIpVersion	The IP version is invalid.	The IP version is invalid.
400	ErrorParametersDirection	The direction is invalid.	The direction is invalid.
400	ErrorParametersSource	The source is invalid.	The source is invalid.
400	ErrorDomainResolve	A domain resolution error occurred.	An error occurred while resolving the domain.
400	ErrorParametersDestination	The Destination parameter is invalid.	The Destination parameter is invalid.
400	ErrorParametersProto	The protocol is invalid.	The protocol is invalid.
400	ErrorParametersDestPort	The dst_port is invalid.	The dst_port is invalid.
400	ErrorParametersAction	The action is invalid.	The action is invalid.
400	ErrorParameters	Parameters error.	Parameter error.
400	ErrorMarshalJSON	An error occurred while encoding JSON.	An error occurred while encoding JSON.
400	ErrorParametersAclUuid	Specified parameter AclUuid is not valid.	Specified parameter AclUuid is not valid.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.