Modifies the descriptions of outbound rules in a security group.

Description

When you modify the rules of a security group by specifying the rule IDs, take note of the following limits:

  • A security group authorization object can be one of the following types: IP address or CIDR block, security group, or prefix list. The type of an existing security group authorization object cannot be modified. If the original authorization object is an IP address, you can change it to another IP address or a CIDR block, but not to a security group or prefix list.
  • The IP address family of the authorization object cannot be modified. For example, if the original authorization object is an IPv4 CIDR block, you cannot change it to an IPv6 CIDR block. If the original authorization object is a prefix list of an IPv4 address family, you cannot change it to a prefix list of an IPv6 address family.
  • The modified security group rule cannot be the same as other existing rules.
  • You cannot delete the value of a non-empty parameter. We recommend that you create a new rule and delete the original rule.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer. OpenAPI Explorer dynamically generates the sample code of the operation for different SDKs.

Request parameters

ParameterTypeRequiredExampleDescription
ActionStringYesModifySecurityGroupEgressRule

The operation that you want to perform. Set the value to ModifySecurityGroupEgressRule.

RegionIdStringYescn-hangzhou

The region ID of the source security group. You can call the DescribeRegions operation to query the most recent list of regions.

ClientTokenStringNo123e4567-e89b-12d3-a456-426655440000

The client token that is used to ensure the idempotence of the request. You can use the client to generate a client token. Make sure that a unique client token is used for each request. The ClientToken value can contain only ASCII characters and cannot exceed 64 characters in length. For more information, see How to ensure idempotence.

SecurityGroupIdStringYessg-bp67acfmxazb4p****

The ID of the security group.

SecurityGroupRuleIdStringNosgr-bp67acfmxazb4q****

The ID of the security group rule.

This parameter is required when you need to modify a rule by specifying its ID.

PolicyStringNoaccept

The authorization policy. Valid values:

  • accept: allows access.
  • drop: denies access and returns no responses.

Default value: accept.

PriorityStringNo1

The priority of security group rule N. Valid values: 1 to 100.

Default value: 1.

IpProtocolStringYestcp

The transport layer protocol. The values of this parameter are case-insensitive. Valid values:

  • ICMP
  • GRE
  • TCP
  • UDP
  • ALL: all protocols are supported.
DestCidrIpStringNo10.0.0.0/8

The destination IPv4 CIDR block. CIDR blocks and IPv4 addresses are supported.

This parameter is empty by default.

Ipv6DestCidrIpStringNo2001:db8:1233:1a00::***

The destination IPv6 CIDR block. CIDR blocks and IPv6 addresses are supported.

Note Only the IP addresses of instances in virtual private clouds (VPCs) are supported. You cannot specify both the Ipv6DestCidrIp parameter and the DestCidrIp parameter.

This parameter is empty by default.

DestGroupIdStringNosg-bp67acfmxa123b****

The ID of the destination security group. You must specify at least one of the DestGroupId and DestCidrIp parameters.

  • At least one of DestGroupId, DestCidrIp, Ipv6DestCidrIp, and DestPrefixListId must be specified.
  • If DestGroupId is specified but DestCidrIp is not, the NicType parameter can be set only to intranet.
  • If both DestGroupId and DestCidrIp are specified, DestCidrIp takes precedence.
DestPrefixListIdStringNopl-x1j1k5ykzqlixdcy****

The ID of the destination prefix list. You can call the DescribePrefixLists operation to query the IDs of available prefix lists.

If you specify DestCidrIp, Ipv6DestCidrIp, or DestGroupId, this parameter is ignored.

PortRangeStringYes80/80

The range of destination ports that correspond to the transport layer protocol for security group rule N. Valid values:

  • When the IpProtocol parameter is set to tcp or udp, the port number range is 1 to 65535. The start port number and the end port number are separated by a forward slash (/). Example: 1/200.
  • When the IpProtocol parameter is set to icmp, the port number range is -1/-1, which indicates all ports.
  • If the IpProtocol parameter is set to gre, the port number range is -1/-1, which indicates all ports.
  • When the IpProtocol parameter is set to all, the port number range is -1/-1, which indicates all ports.
SourceCidrIpStringNo10.0.0.0/8

The source IPv4 CIDR block. CIDR blocks and IPv4 addresses are supported.

This parameter is empty by default.

Ipv6SourceCidrIpStringNo2001:db8:1234:1a00::***

The source IPv6 CIDR block. CIDR blocks and IPv6 addresses are supported.

Note Only the IP addresses of instances in VPCs are supported. You cannot specify both the Ipv6SourceCidrIp parameter and the SourceCidrIp parameter.

This parameter is empty by default.

SourcePortRangeStringNo80/80

The range of source ports that correspond to the transport layer protocol. Valid values:

  • When the IpProtocol parameter is set to tcp or udp, the port number range is 1 to 65535. The start port number and the end port number are separated by a forward slash (/). Example: 1/200.
  • When the IpProtocol parameter is set to icmp, the port number range is -1/-1, which indicates all ports.
  • If the IpProtocol parameter is set to gre, the port number range is -1/-1, which indicates all ports.
  • When the IpProtocol parameter is set to all, the port number range is -1/-1, which indicates all ports.
DestGroupOwnerAccountStringNoEcsforCloud@Alibaba.com

The Alibaba Cloud account that manages the destination security group when you set security group rule N across accounts.

DestGroupOwnerIdLongNo1234567890

The ID of the Alibaba Cloud account that manages the destination security group when you set security group rule N across accounts.

NicTypeStringNointranet

You cannot modify this parameter when you modify a security group rule by specifying its ID.

Instead, you can add a new rule that meets your requirements and delete the original rule.

DescriptionStringNoThis is a new securitygroup rule.

The description of the security group rule. The description must be 1 to 512 characters in length.

Response parameters

ParameterTypeExampleDescription
RequestIdString473469C7-AA6F-4DC5-B3DB-A3DC0DE3C83E

The ID of the request.

Examples

Sample requests

https://ecs.aliyuncs.com/?Action=ModifySecurityGroupEgressRule
&SecurityGroupId=sg-bp67acfmxazb4p****
&SecurityGroupRuleId=sgr-dcd43def****
&SourcePrefixListId=pl-x1j1k5ykzqlixdew****
&<Common request parameters>

Sample success responses

XML format

HTTP/1.1 200 OK
Content-Type:application/xml

<ModifySecurityGroupEgressRuleResponse>
    <RequestId>CEF72CEB-54B6-4AE8-B225-F876FF7BA984</RequestId>
</ModifySecurityGroupEgressRuleResponse>

JSON format

HTTP/1.1 200 OK
Content-Type:application/json

{
  "RequestId" : "CEF72CEB-54B6-7AE8-B225-F876FF7BA984"
}

Error codes

HttpCodeError codeError messageDescription
400OperationDeniedThe specified IpProtocol does not exist or IpProtocol and PortRange do not match.The error message returned because the specified IpProtocol parameter does not exist or does not match the specified PortRange parameter.
400InvalidIpProtocol.MalformedThe specified parameter PortRange is not valid.The error message returned because the specified IpProtocol or PortRange parameter is invalid.
400InvalidDestCidrIp.MalformedThe specified parameter DestCidrIp is not valid.The error message returned because the specified DestCidrIp parameter is invalid.
400InvalidPolicy.MalformedThe specified parameter Policy is not valid.The error message returned because the specified Policy parameter is invalid.
400InvalidNicType.ValueNotSupportedThe specified NicType does not exist.The error message returned because the specified NicType parameter does not exist.
400InvalidDestGroupId.MismatchSpecified security group and destination group are not in the same VPC.The error message returned because the specified security group and the destination security group do not belong to the same VPC.
400InvalidDestGroup.NotFoundSpecified destination security group does not exist.The error message returned because the specified destination security group does not exist.
400InvalidPriority.MalformedThe specified parameter Priority is not valid.The error message returned because the specified priority of the security group rule is invalid. Enter a priority value in the range of 1 to 100.
400InvalidPriority.ValueNotSupportedThe specified Priority is invalid.The error message returned because the specified Priority parameter is invalid.
400InvalidNicType.ValueNotSupportedThe specified NicType is not valid.The error message returned because the specified NicType parameter does not exist.
400InvalidSecurityGroupDiscription.MalformedThe specified security group rule description is not valid.The error message returned because the specified Description parameter is invalid.
400InvalidSecurityGroup.InvalidNetworkTypeThe specified security group network type is not support this operation, please check the security group network types. For VPC security groups, ClassicLink must be enabled.The error message returned because the operation is not supported while the security group is of the current network type. You must enable ClassicLink for security groups in VPCs.
400MissingParameter.DestOne of the parameters DestCidrIp, DestGroupId or DestPrefixListId must be specified.The error message returned because the DestCidrIp, DestGroupId, and DestPrefixListId parameters are all empty. At least one of the parameters must be specified.
400InvalidIpProtocol.ValueNotSupportedThe specified parameter IpProtocol should not be null and only tcp, udp, icmp, gre or all is supported. Ignore case.The error message returned because the specified IpProtocol parameter is invalid. The valid values of this parameter are tcp, udp, icmp, gre, and all.
400InvalidPriority.ValueNotSupportedThe parameter Priority is invalid.The error message returned because the specified Priority parameter is invalid.
400InvalidSourcePortRange.MalformedThe specified parameter SourcePortRange is not valid.The error message returned because the specified SourcePortRange parameter is invalid.
400InvalidParam.SourceCidrIpThe specified param SourceCidrIp is not valid.The error message returned because the specified SourceCidrIp parameter is invalid.
400InvalidParam.DestCidrIpThe specified param DestCidrIp is not valid.The error message returned because the specified DestCidrIp parameter is invalid.
400InvalidParameter.ConflictIPv6 and IPv4 addresses cannot exist at the same time.The error message returned because IPv6 addresses and IPv4 addresses are both specified.
403InvalidDestGroupId.MismatchNicType is required or NicType expects intranet.The error message returned because the NicType parameter is not specified or is not set to intranet.
403MissingParameterThe input parameter DestGroupId or DestCidrIp cannot be both blank.The error message returned because the DestGroupId and DestCidrIp parameters cannot be empty at the same time.
403AuthorizationLimitExceedThe limit of authorization records in the security group reaches.The error message returned because the maximum number of rules in the security group has been reached.
403InvalidParamter.ConflictThe specified SecurityGroupId should be different from the SourceGroupId.The error message returned because the destination security group is the same as the source security group.
403InvalidNetworkType.ConflictThe specified SecurityGroup network type should be same with SourceGroup network type (vpc or classic).The error message returned because the network type of the specified security group is different from that of the source security group.
403InvalidSecurityGroup.IsSameThe authorized SecurityGroupId should be different from the DestGroupId.The error message returned because the authorized security group cannot be the same as the current destination security group.
403InvalidOperation.ResourceManagedByCloudProduct%sThe error message returned because security groups managed by cloud services cannot be modified.
404InvalidSecurityGroupId.NotFoundThe specified SecurityGroupId does not exist.The error message returned because the specified security group does not exist in this account. Check whether the security group ID is correct.
404InvalidDestGroupId.NotFoundThe DestGroupId provided does not exist in our records.The error message returned because the specified DestGroupId parameter does not exist.
404InvalidPrefixListId.NotFoundThe specified prefix list was not found.The error message returned because the specified prefix list does not exist.
500InternalErrorThe request processing has failed due to some unknown error.The error message returned because an internal error occurred. Try again later.

For a list of error codes, see Service error codes.