Configures PrivateZone.
Operation description
Alibaba Cloud DNS PrivateZone (PrivateZone) is an Alibaba Cloud private domain name resolution and management service based on Virtual Private Cloud (VPC). After you attach virtual border routers (VBRs) and Cloud Connect Network (CCN) instances to a Cloud Enterprise Network (CEN) instance, you can enable the on-premises networks connected to the VBRs and CCN instances to access PrivateZone through the CEN instance.
Usage notes
- The on-premises networks connected to VBRs or CCN instances must be deployed in the same region as the PrivateZone service. For example, if the PrivateZone service is deployed in the China (Beijing) region, only on-premises networks connected to VBRs or CCN instances in the China (Beijing) region can access the PrivateZone service.
- RoutePrivateZoneInCenToVpc is an asynchronous operation. After you send a request, the request ID is returned but the operation is still being performed in the system background. You can call DescribeCenPrivateZoneRoutes to query the status of PrivateZone.
- If PrivateZone is in the Creating state, access to PrivateZone is being configured. In this case, you can query PrivateZone configurations but cannot perform other operations.
- If PrivateZone is in the Active state, access to PrivateZone is enabled.
- If PrivateZone is in the Failed state, configurations of access to PrivateZone failed.
Prerequisites
Before you call RoutePrivateZoneInCenToVpc, make sure that the following conditions are met:
- PrivateZone is deployed. For more information, see PrivateZone quick start.
- The following network instances are attached to the same CEN instance: the VPC that is associated with the PrivateZone service, and the VBR and CCN instance that want to access the PrivateZone service. For more information, see AttachCenChildInstance .
- If your on-premises network uses a CCN instance to connect to Alibaba Cloud and the account that owns the CCN instance is different from the account that owns the VPC or CEN instance, you must grant the CCN instance required permissions. For more information, see Grant permissions to CCN.
Debugging
Authorization information
The following table shows the authorization information corresponding to the API. The authorization information can be used in the Action policy element to grant a RAM user or RAM role the permissions to call this API operation. Description:
- Operation: the value that you can use in the Action element to specify the operation on a resource.
- Access level: the access level of each operation. The levels are read, write, and list.
- Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level,
All Resourcesis used in the Resource type column of the operation.
- Condition Key: the condition key that is defined by the cloud service.
- Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
| Operation | Access level | Resource type | Condition key | Associated operation |
|---|---|---|---|---|
| cen:RoutePrivateZoneInCenToVpc | create |
|
| none |
Request parameters
| Parameter | Type | Required | Description | Example |
|---|---|---|---|---|
| CenId | string | Yes | The ID of the CEN instance. | cen-7qthudw0ll6jmc**** |
| AccessRegionId | string | Yes | The ID of the region where PrivateZone is accessed. This region refers to the region in which PrivateZone is accessed by clients. You can call the DescribeChildInstanceRegions operation to query the most recent region list. | cn-hangzhou |
| HostRegionId | string | Yes | The ID of the region where PrivateZone is deployed. | cn-hangzhou |
| HostVpcId | string | Yes | The ID of the VPC that is associated with PrivateZone. | vpc-bp1h8vbrbcgohcju5**** |
Response parameters
Examples
Sample success responses
JSONformat
{
"RequestId": "C0245BEF-52AC-44A8-A776-EF96FD26A5CA\t"
}Error codes
| HTTP status code | Error code | Error message | Description |
|---|---|---|---|
| 400 | OperationUnsupported.CrossRegionNotSupport | Operation Failed. Host region Id is not equal to access region Id, VPC or VBR not support cross region privatezone service. | The host region ID is different from the service region ID. The VPC or VBR does not support PrivateZone across regions. |
| 400 | Forbidden.PrivatezoneServiceNotAuthorize | Privatezone service not to grant authorization. | The error message returned because PrivateZone does not have the required permissions. |
| 400 | ParameterIllegal.AccessRegionIdNoCCN | Parameter Access RegionId illegal. | - |
| 400 | InvalidParameter | Invalid parameter. | The error message returned because the parameter is set to an invalid value. |
| 400 | Unauthorized | The AccessKeyId is unauthorized. | The error message returned because you do not have the permissions to perform this operation. |
| 403 | InvalidOperation.PvtzNotAssociatedWithVpc | Privatezone not associated with the specified vpc. | The error message returned because PrivateZone is not associated with the specified VPC. |
| 409 | InvalidOperation.PrivatezoneRouteExisted | Privatezone routes already existed. | The error message returned because the PrivateZone route already exists. |
| 409 | InvalidOperation.VpcNotAttachedToCen | Vpc not attached to cen. | The error message returned because the specified VPC is not attached to a CEN instance. |
| 409 | InvalidOperation.UnmatchRouteInVpcRegion | Operation Failed.Unmatch route in vpc region. | The VPC routes do not match the match conditions. |
For a list of error codes, visit the Service error codes.
Change history
| Change time | Summary of changes | Operation |
|---|---|---|
| 2022-12-22 | The Error code has changed | View Change Details |