DocsICP FilingConsole
官方文档
首页

Create a VPC firewall to protect traffic between a VPC and a network instance attached to a Basic Edition transit router

更新时间：
复制 MD 格式
产品详情
我的收藏

Use the alicloud_cloud_firewall_vpc_firewall_cen Terraform resource to create a virtual private cloud (VPC) firewall that protects access traffic between a VPC and a network instance attached to a Basic Edition transit router of a Cloud Enterprise Network (CEN) instance.

Run the sample code in this topic directly in Terraform Explorer. For more information, visit Terraform Explorer.

Prerequisites

Before you begin, ensure that you have:

  • A RAM user with the required permissions. An Alibaba Cloud root account carries full permissions on all resources, which creates significant security exposure if leaked. Use a Resource Access Management (RAM) user with an AccessKey pair instead. See Create a RAM user and Create an AccessKey pair. Attach the following policy to the RAM user to grant the minimum required permissions on Cloud Firewall, VPC, and CEN:

    {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "yundun-cloudfirewall:*",
                "yundun-ndr:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "vpc:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "vpc:CreateVSwitch",
                "vpc:DescribeVSwitches",
                "vpc:DeleteVSwitch"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cen:*"
            ],
            "Resource": "*"
        }
    ]
}

    For more information, see Grant permissions to RAM users.

  • A Terraform environment. Choose one of the following options:

    Important

    Terraform 0.12.28 or later is required. Run terraform --version to check your installed version.

The resources created in this example may incur fees. Release or unsubscribe from the resources when you no longer need them.

Resources used

alicloud_cloud_firewall_vpc_firewall_cen：VPCboundary firewall。

Create a VPC firewall

Step 1: Write the configuration

Create a working directory and a main.tf file in it. The following configuration creates the full dependency chain: two VPCs with vSwitches, a CEN instance, two network instance connections, and the VPC firewall.

variable "region" {
  default = "cn-qingdao"
}
provider "alicloud" {
  region = var.region
}
data "alicloud_account" "current" {
}
# Create VPC 1.
resource "alicloud_vpc" "vpc" {
  vpc_name   = "cen-vpc-01"
  cidr_block = "172.16.0.0/12"
}
# Create VPC 2.
resource "alicloud_vpc" "vpc1" {
  vpc_name   = "cen-vpc-02"
  cidr_block = "172.16.0.0/12"
}
# Create a vSwitch and allocate the CIDR block 172.16.1.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw" {
  vpc_id       = alicloud_vpc.vpc.id
  cidr_block   = "172.16.1.0/24"
  zone_id      = "cn-qingdao-b"
  vswitch_name = "terraform-example-1"
}
# Create a vSwitch and allocate the CIDR block 172.16.0.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw1" {
  vpc_id       = alicloud_vpc.vpc.id
  cidr_block   = "172.16.0.0/24"
  zone_id      = "cn-qingdao-c"
  vswitch_name = "terraform-example-2"
}
# Create a vSwitch and allocate the CIDR block 172.16.4.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw2" {
  vpc_id       = alicloud_vpc.vpc1.id
  cidr_block   = "172.16.4.0/24"
  zone_id      = "cn-qingdao-b"
  vswitch_name = "terraform-example-11"
}
# Create a vSwitch and allocate the CIDR block 172.16.5.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw3" {
  vpc_id       = alicloud_vpc.vpc1.id
  cidr_block   = "172.16.5.0/24"
  zone_id      = "cn-qingdao-c"
  vswitch_name = "terraform-example-22"
}
# The Cloud Enterprise Network (CEN) instance.
resource "alicloud_cen_instance" "example" {
  # The name of the CEN instance.
  cen_instance_name = "tf_example"
  # The description.
  description = "an example for cen"
}
# Create Network Instance Connection 1 to the transit router.
resource "alicloud_cen_instance_attachment" "example" {
  instance_id              = alicloud_cen_instance.example.id
  child_instance_id        = alicloud_vpc.vpc.id
  child_instance_type      = "VPC"
  child_instance_region_id = "cn-qingdao"
}
# Create Network Instance Connection 2 to the transit router.
resource "alicloud_cen_instance_attachment" "example1" {
  instance_id              = alicloud_cen_instance.example.id
  child_instance_id        = alicloud_vpc.vpc1.id
  child_instance_type      = "VPC"
  child_instance_region_id = "cn-qingdao"
}
# Wait for CEN routing to propagate before creating the firewall.
resource "time_sleep" "wait_before_firewall" {
  depends_on = [
    alicloud_cen_instance_attachment.example,
    alicloud_cen_instance_attachment.example1
  ]
  create_duration = "720s" # Adjust based on your network topology and observed propagation time.
}
# Trigger the wait dependency chain.
resource "null_resource" "wait_for_firewall" {
  provisioner "local-exec" {
    command = "echo waiting for firewall to be ready"
  }
  depends_on = [time_sleep.wait_before_firewall]
}
# The VPC firewall for the Basic Edition transit router.
resource "alicloud_cloud_firewall_vpc_firewall_cen" "default" {
  depends_on = [
    null_resource.wait_for_firewall
  ]
  timeouts {
    create = "30m" # The timeout period of the creation operation.
  }
  # The ID of the CEN instance.
  cen_id = alicloud_cen_instance.example.id
  # The details of the VPC.
  local_vpc {
    # The ID of the VPC for which the VPC firewall is created.
    network_instance_id = alicloud_cen_instance_attachment.example.child_instance_id
  }
  # The status of the VPC firewall.
  status = "open"
  # Optional. The ID of the member of the current Alibaba Cloud account.
  member_uid = data.alicloud_account.current.id
  # The region ID of the VPC.
  vpc_region = var.region
  # The name of the VPC firewall.
  vpc_firewall_name = "tf-test"
}
The time_sleep resource introduces a 720-second (12-minute) wait after the CEN instance attachments are created. This delay is required because VPC firewall creation depends on CEN routing state being fully propagated — a process that takes time after network instance connections are established. The 720s value works for this example; adjust it based on your network topology and observed propagation time.

Step 2: Initialize Terraform

terraform init

A successful initialization returns output similar to:

Initializing the backend...

Initializing provider plugins...
- Checking for available provider plugins...
- Downloading plugin for provider "alicloud" (hashicorp/alicloud) 1.203.0...

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Step 3: Preview the execution plan

terraform plan

Step 4: Apply the configuration

terraform apply

When prompted, enter yes and press Enter. The command creates 12 resources in sequence. A successful run returns:

Plan: 12 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

alicloud_vpc.vpc1: Creating...
alicloud_cen_instance.example: Creating...
alicloud_vpc.vpc: Creating...
alicloud_cen_instance.example: Creation complete after 6s [id=cen-igzi112vm9qo95y***]
alicloud_vpc.vpc: Creation complete after 6s [id=vpc-m5e80rjklhxmpvjpc6***]
alicloud_vswitch.vsw: Creating...
alicloud_vpc.vpc1: Creation complete after 6s [id=vpc-m5e31tqo1qwevzb8xy***]
alicloud_vswitch.vsw1: Creating...
alicloud_cen_instance_attachment.example: Creating...
alicloud_vswitch.vsw2: Creating...
alicloud_cen_instance_attachment.example1: Creating...
alicloud_vswitch.vsw3: Creating...
alicloud_vswitch.vsw: Creation complete after 3s [id=vsw-m5e8ziezyqzqv0sc61***]
alicloud_vswitch.vsw2: Creation complete after 3s [id=vsw-m5eefi2ucwn9v6cf9d***]
alicloud_vswitch.vsw1: Creation complete after 7s [id=vsw-m5e60062s0hrie96wd***]
alicloud_vswitch.vsw3: Creation complete after 7s [id=vsw-m5eqoruknlh503wmtf***]
alicloud_cen_instance_attachment.example: Still creating... [10s elapsed]
alicloud_cen_instance_attachment.example1: Still creating... [10s elapsed]
alicloud_cen_instance_attachment.example: Still creating... [20s elapsed]
alicloud_cen_instance_attachment.example1: Still creating... [20s elapsed]
alicloud_cen_instance_attachment.example: Creation complete after 25s [id=cen-igzi112vm9qo95y***:vpc-m5e80rjklhxmpvjpc6***:VPC:cn-qingdao]
alicloud_cen_instance_attachment.example1: Still creating... [30s elapsed]
alicloud_cen_instance_attachment.example1: Creation complete after 35s [id=cen-igzi112vm9qo95y***:vpc-m5e31tqo1qwevzb8xy***:VPC:cn-qingdao]
time_sleep.wait_before_firewall: Creating...
time_sleep.wait_before_firewall: Still creating... [10s elapsed]
time_sleep.wait_before_firewall: Still creating... [20s elapsed]
time_sleep.wait_before_firewall: Still creating... [30s elapsed]
time_sleep.wait_before_firewall: Still creating... [40s elapsed]
time_sleep.wait_before_firewall: Still creating... [50s elapsed]
time_sleep.wait_before_firewall: Still creating... [1m0s elapsed]
time_sleep.wait_before_firewall: Still creating... [1m10s elapsed]
time_sleep.wait_before_firewall: Still creating... [1m20s elapsed]
time_sleep.wait_before_firewall: Creation complete after 1m21s [id=2024-10-31T08:49:08Z]
null_resource.wait_for_firewall: Creating...
null_resource.wait_for_firewall: Provisioning with 'local-exec'...
null_resource.wait_for_firewall (local-exec): Executing: ["/bin/sh" "-c" "echo waiting for firewall to be ready"]
null_resource.wait_for_firewall (local-exec): waiting for firewall to be ready
null_resource.wait_for_firewall: Creation complete after 0s [id=8138826525954951***]
alicloud_cloud_firewall_vpc_firewall_cen.default: Creating...
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [10s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [20s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [30s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [40s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [50s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m0s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m10s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m20s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m30s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m40s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [1m50s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m0s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m10s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m20s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m30s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m40s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [2m50s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m0s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m10s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m20s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m30s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m40s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [3m50s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m0s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m10s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m20s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m30s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m40s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Still creating... [4m50s elapsed]
alicloud_cloud_firewall_vpc_firewall_cen.default: Creation complete after 4m55s [id=vfw-1bc3b436d49b46ac8***]

Apply complete!  Resources: 12 added, 0 changed, 0 destroyed.

Verify the result

Using terraform show

Run the following command to view the details of the created VPC firewall:

terraform show
image

Using the Cloud Firewall console

Log on to the Cloud Firewall console, go to the Cloud Firewall consoleFirewall Settings page, and click the VPC Firewall tab. Search by the firewall ID to view the VPC firewall details.

image

Release resources

When you no longer need these resources, run the following command to release them:

terraform destroy

For more information about the terraform destroy command, see Common commands.

Complete sample code

Run the sample code in this topic directly in Terraform Explorer. For more information, visit Terraform Explorer.
variable "region" {
  default = "cn-qingdao"
}
provider "alicloud" {
  region = var.region
}
data "alicloud_account" "current" {
}
# Create VPC 1.
resource "alicloud_vpc" "vpc" {
  vpc_name   = "cen-vpc-01"
  cidr_block = "172.16.0.0/12"
}
# Create VPC 2.
resource "alicloud_vpc" "vpc1" {
  vpc_name   = "cen-vpc-02"
  cidr_block = "172.16.0.0/12"
}
# Create a vSwitch and allocate the CIDR block 172.16.1.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw" {
  vpc_id       = alicloud_vpc.vpc.id
  cidr_block   = "172.16.1.0/24"
  zone_id      = "cn-qingdao-b"
  vswitch_name = "terraform-example-1"
}
# Create a vSwitch and allocate the CIDR block 172.16.0.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw1" {
  vpc_id       = alicloud_vpc.vpc.id
  cidr_block   = "172.16.0.0/24"
  zone_id      = "cn-qingdao-c"
  vswitch_name = "terraform-example-2"
}
# Create a vSwitch and allocate the CIDR block 172.16.4.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw2" {
  vpc_id       = alicloud_vpc.vpc1.id
  cidr_block   = "172.16.4.0/24"
  zone_id      = "cn-qingdao-b"
  vswitch_name = "terraform-example-11"
}
# Create a vSwitch and allocate the CIDR block 172.16.5.0/24 to the vSwitch.
resource "alicloud_vswitch" "vsw3" {
  vpc_id       = alicloud_vpc.vpc1.id
  cidr_block   = "172.16.5.0/24"
  zone_id      = "cn-qingdao-c"
  vswitch_name = "terraform-example-22"
}
# The Cloud Enterprise Network (CEN) instance.
resource "alicloud_cen_instance" "example" {
  # The name of the CEN instance.
  cen_instance_name = "tf_example"
  # The description.
  description = "an example for cen"
}
# Create Network Instance Connection 1 to the transit router.
resource "alicloud_cen_instance_attachment" "example" {
  instance_id              = alicloud_cen_instance.example.id
  child_instance_id        = alicloud_vpc.vpc.id
  child_instance_type      = "VPC"
  child_instance_region_id = "cn-qingdao"
}
# Create Network Instance Connection 2 to the transit router.
resource "alicloud_cen_instance_attachment" "example1" {
  instance_id              = alicloud_cen_instance.example.id
  child_instance_id        = alicloud_vpc.vpc1.id
  child_instance_type      = "VPC"
  child_instance_region_id = "cn-qingdao"
}
# Wait for CEN routing to propagate before creating the firewall.
resource "time_sleep" "wait_before_firewall" {
  depends_on = [
    alicloud_cen_instance_attachment.example,
    alicloud_cen_instance_attachment.example1
  ]
  create_duration = "720s" # Adjust based on your network topology and observed propagation time.
}
# Trigger the wait dependency chain.
resource "null_resource" "wait_for_firewall" {
  provisioner "local-exec" {
    command = "echo waiting for firewall to be ready"
  }
  depends_on = [time_sleep.wait_before_firewall]
}
# The VPC firewall for the Basic Edition transit router.
resource "alicloud_cloud_firewall_vpc_firewall_cen" "default" {
  depends_on = [
    null_resource.wait_for_firewall
  ]
  timeouts {
    create = "30m" # The timeout period of the creation operation.
  }
  # The ID of the CEN instance.
  cen_id = alicloud_cen_instance.example.id
  # The details of the VPC.
  local_vpc {
    # The ID of the VPC for which the VPC firewall is created.
    network_instance_id = alicloud_cen_instance_attachment.example.child_instance_id
  }
  # The status of the VPC firewall.
  status = "open"
  # Optional. The ID of the member of the current Alibaba Cloud account.
  member_uid = data.alicloud_account.current.id
  # The region ID of the VPC.
  vpc_region = var.region
  # The name of the VPC firewall.
  vpc_firewall_name = "tf-test"
}
Previous：Create a Cloud Firewall address bookNext：Create a VPC firewall for traffic between two VPCs connected by Express Connect