Grants a transit router permissions on network instances that belong to another Alibaba Cloud account. To connect a transit router of Account B to a network instance of Account A, you must use Account A to grant permissions to the transit router of Account B.
Operation description
-
The
GrantInstanceToTransitRouteroperation can be used to grant transit routers permissions on network instances that belong to other Alibaba Cloud accounts, including virtual private clouds (VPCs), virtual border routers (VBRs), IPsec-VPN connections, and Express Connect Router (ECRs).To grant transit routers permissions on Cloud Connect Network (CCN) instances, call the GrantInstanceToCbn operation.
-
Before you call
GrantInstanceToTransitRouter, take note of the billing rules, permission limits, and prerequisites on permission management of transit routers. For more information, see Acquire permissions to connect to a network instance that belongs to another account. -
Before you grant a transit router permissions on a network instance, make sure that the following requirements are met:
The account to which the network instance belongs and the account to which the transit router belongs are of the same type.
The ID of the Alibaba Cloud account to which the transit router belongs is obtained.
The ID of the Cloud Enterprise Network (CEN) instance to which the Enterprise Edition transit router belongs is obtained.
Before you grant a transit router permissions on a VBR, contact your account manager to acquire permissions on the VBR.
Before you grant a transit router permissions on an IPsec-VPN connection, make sure that the IPsec-VPN connection is not associated with a resource.
If the IPsec-VPN connection is attached to a VPN gateway, the IPsec-VPN connection cannot be attached to transit routers within the same account or different accounts.
If the IPsec-VPN connection is attached to a transit router, detach the IPsec-VPN connection from the transit router. For more information, see Delete a network instance connection.
Debugging
Authorization information
The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:
- Operation: the value that you can use in the Action element to specify the operation on a resource.
- Access level: the access level of each operation. The levels are read, write, and list.
- Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level,
All Resourcesis used in the Resource type column of the operation.
- Condition Key: the condition key that is defined by the cloud service.
- Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
| Operation | Access level | Resource type | Condition key | Associated operation |
|---|---|---|---|---|
| cen:GrantInstanceToTransitRouter | create | *All Resources * |
| none |
Request parameters
| Parameter | Type | Required | Description | Example |
|---|---|---|---|---|
| CenId | string | Yes | Enter the ID of the Cloud Enterprise Network (CEN) instance to which the transit router belongs. | cen-44m0p68spvlrqq**** |
| InstanceId | string | Yes | The ID of the network instance. | vpc-bp1h8vbrbcgohcju5**** |
| InstanceType | string | Yes | The type of network instance. Valid values:
| VPC |
| RegionId | string | Yes | The ID of the region where the network instance is deployed. You can call the DescribeChildInstanceRegions operation to query the most recent region list. | cn-hangzhou |
| CenOwnerId | long | Yes | The ID of the Alibaba Cloud account to which the CEN instance belongs. | 1250123456123456 |
| OrderType | string | No | The entity that pays the fees of the network instance. Valid values:
| PayByCenOwner |
Response parameters
Examples
Sample success responses
JSONformat
{
"RequestId": "C6E5992C-A57B-5A6C-9B26-568074DC68BA"
}Error codes
| HTTP status code | Error code | Error message | Description |
|---|---|---|---|
| 400 | Forbbiden.TransitRouterServiceNotOpen | The user has not open transit router service. | The error message returned because the transit router is disabled. Enable the transit router and try again. |
| 400 | NoPermission.AliyunServiceRoleForCEN | You are not authorized to create the service linked role. Role Name: AliyunServiceRoleForCEN. Service Name: cen.aliyuncs.com. Make sure that the user has been granted the ram:CreateServiceLinkedRole permission. | The error message because you do not have the permissions to create the service-linked role whose role name is AliyunServiceRoleForCEN and service name is cen.aliyuncs.com. You must acquire the ram:CreateServiceLinkedRole permission before you can create the service-linked role. |
| 400 | IllegalParam.CenId | The specified CenId is invalid. | The error message returned because the ID of the CEN instance is invalid. |
| 400 | OperationFailed.TaskConflict | The operation is too frequent, please wait a moment and try again. | The error message returned because this operation is performed at a high frequency. Try again later. |
| 400 | InvalidVbr.NotFound | vbr is not found. | - |
| 400 | OperationFailed.GrantCrossAccountExist | Cross-account authorization already exists. | Cross-account authorization already exists. |
| 400 | Forbidden.TransitRouterServiceExpired | The transit router service is out of service. | The transit router service has been suspended due for payment. Please renew the service and try again. |
| 400 | InvalidParameter | Invalid parameter. | The error message returned because the parameter is set to an invalid value. |
| 400 | Unauthorized | The AccessKeyId is unauthorized. | The error message returned because you do not have the permissions to perform this operation. |
| 404 | InvalidInstanceId.NotFound | InstanceId is not found. | - |
For a list of error codes, visit the Service error codes.
Change history
| Change time | Summary of changes | Operation |
|---|---|---|
| 2024-10-28 | The Error code has changed | View Change Details |
| 2024-07-10 | The Error code has changed | View Change Details |
| 2023-12-26 | The Error code has changed | View Change Details |