全部產品
Search
文件中心

:ALIYUN::CLOUDFW::VpcFirewallControlPolicy

更新時間:Nov 19, 2024

ALIYUN::CLOUDFW::VpcFirewallControlPolicy類型用於為指定VPC邊界防火牆策略組添加存取控制策略。

文法

{
  "Type": "ALIYUN::CLOUDFW::VpcFirewallControlPolicy",
  "Properties": {
    "Destination": String,
    "ApplicationName": String,
    "Description": String,
    "SourceType": String,
    "DestPort": String,
    "AclAction": String,
    "Lang": String,
    "DestinationType": String,
    "VpcFirewallId": String,
    "Source": String,
    "DestPortType": String,
    "Proto": String,
    "RegionId": String,
    "NewOrder": String,
    "DestPortGroup": String,
    "Release": Boolean,
    "RepeatType": String,
    "StartTime": Integer,
    "RepeatEndTime": String,
    "RepeatDays": List,
    "EndTime": Integer,
    "RepeatStartTime": String,
    "ApplicationNameList": List,
    "MemberUid": String
  }
}

屬性

屬性名稱

類型

必須

允許更新

描述

約束

AclAction

String

VPC邊界防火牆存取控制策略中設定的流量通過Cloud Firewall的方式(動作)。

取值:

  • accept:允許存取。

  • drop:拒絕。

  • log:觀察。

ApplicationName

String

VPC邊界防火牆存取控制策略支援的應用類型。

取值:

  • FTP

  • HTTP

  • HTTPS

  • MySQL

  • SMTP

  • SMTPS

  • RDP

  • VNC

  • SSH

  • Redis

  • MQTT

  • MongoDB

  • Memcache

  • SSL

  • ANY(表示支援所有的應用類型)

Description

String

VPC邊界防火牆存取控制策略的描述資訊。

Destination

String

VPC邊界防火牆存取控制策略中流量訪問的目的地址。

取值:

  • 當DestinationType取值為net時:目的CIDR地址。例如:10.2.3.0/24。

  • 當DestinationType取值為group時:目的地址簿名稱。例如:db_group。

  • 當DestinationType取值為domain時:目的網域名稱。例如:*.aliyuncs.com。

DestinationType

String

VPC邊界防火牆存取控制策略中流量訪問的目的地址類型。

取值:

  • net:目的網段(CIDR)。

  • group:目的地址簿。

  • domain:目的網域名稱。

NewOrder

String

VPC邊界防火牆存取控制策略生效的優先順序。

優先順序數字從1開始順序遞增,優先順序數字越小,優先順序越高。1代表最高優先順序。

說明

-1表示優先順序最低。

Proto

String

VPC邊界防火牆存取控制策略中流量訪問的安全性通訊協定類型。

取值:

  • ANY(不確定具體協議類型時可設定為ANY)

  • TCP

  • UDP

  • ICMP

Source

String

VPC邊界防火牆存取控制策略中的源地址。

取值:

  • 當SourceType取值為net時:源CIDR。例如:10.2.3.0/24。

  • 當SourceType取值為group時:源地址簿名稱。例如:db_group。

SourceType

String

VPC邊界防火牆存取控制策略中的源地址類型。

取值:

  • net:源網段(CIDR)。

  • group:源地址簿。

VpcFirewallId

String

VPC邊界防火牆存取控制策略組ID。

取值:

  • 當VPC邊界防火牆防護雲企業網時:雲企業網執行個體ID。例如:cen-ervw5jbw1234*****。

  • 當VPC邊界防火牆防護Express Connect時:VPC邊界防火牆執行個體ID。例如:vfw-a42bbb748c91234*****。

您可以調用DescribeVpcFirewallAclGroupList - 擷取VPC防火牆所有存取控制策略組資訊擷取VPC邊界防火牆存取控制策略組ID。

DestPort

String

VPC邊界防火牆存取控制策略中流量訪問的目的連接埠。

當DestPortType取值為port時,需要設定該參數。

DestPortGroup

String

VPC邊界防火牆存取控制策略中流量訪問的目的連接埠地址簿名稱。

當DestPortType取值為group時,需指定該參數。

DestPortType

String

VPC邊界防火牆存取控制策略中流量訪問的目的連接埠類型。

取值:

  • port:連接埠。

  • group:連接埠地址簿。

Lang

String

請求和接收訊息的語言類型。

取值:

  • zh:中文。

  • en:英文。

RegionId

String

地區ID。

取值:

  • cn-hangzhou(預設值):杭州。

  • ap-southeast-1:新加坡。

Release

Boolean

存取控制策略的啟用狀態。

策略建立後預設啟用該策略。取值:

  • true:啟用存取控制策略

  • false:不啟用存取控制策略

RepeatType

String

存取控制策略的策略有效期間的重複類型。

取值:

  • Permanent(預設):總是

  • None:指定單次時間

  • Daily:每天

  • Weekly:每周

  • Monthly:每月

StartTime

Integer

存取控制策略的策略有效期間的開始時間。

使用秒級時間戳記格式表示。必須為整點或半點鐘時間,且小於結束時間至少半小時。

說明

當 RepeatType 為 Permanent 時,StartTime 為空白。當 RepeatType 為 None、Daily、Weekly、Monthly 時,StartTime 必須有值,您需要設定開始時間。

RepeatEndTime

String

存取控制策略的策略有效期間的重複結束時間。

例如:23:30,必須為整點或半點鐘時間,且大於重複開始時間至少半小時。

說明

當 RepeatType 為 Permanent、None 時,RepeatEndTime 為空白。當 RepeatType 為 Daily、Weekly、Monthly 時,RepeatEndTime 必須有值,您需要設定重複結束時間。

RepeatDays

List

存取控制策略的策略有效期間的重複日期集合。

  • 當 RepeatType 為PermanentNoneDaily時,RepeatDays 為空白集合。 例如:[]。

  • 當 RepeatType 為 Weekly 時,RepeatDays 不可為空。 例如:[0, 6]。

說明

RepeatType 設定為 Weekly 時,RepeatDays 不允許重複。

  • 當 RepeatType 為Monthly時,RepeatDays 不可為空。 例如:[1, 31]。

說明

RepeatType 設定為 Monthly 時,RepeatDays 不允許重複。

EndTime

Integer

存取控制策略的策略有效期間的結束時間。

使用秒級時間戳記格式表示。必須為整點或半點鐘時間,且大於開始時間至少半小時。

說明

當 RepeatType 為 Permanent 時,EndTime 為空白。當 RepeatType 為 None、Daily、Weekly、Monthly 時,EndTime 必須有值,您需要設定結束時間。

RepeatStartTime

String

存取控制策略的策略有效期間的重複開始時間。

例如:08:00,必須為整點或半點鐘時間,且小於重複結束時間至少半小時。

說明

當 RepeatType 為 Permanent、None 時,RepeatStartTime 為空白。當 RepeatType 為 Daily、Weekly、Monthly 時,RepeatStartTime 必須有值,您需要設定重複開始時間。

ApplicationNameList

List

應用程式名稱。

MemberUid

String

Cloud Firewall成員帳號的 UID。

傳回值

Fn::GetAtt

AclUuid:安全存取控制策略的唯一標識ID。

樣本

YAML格式

ROSTemplateFormatVersion: '2015-09-01'
Parameters:
  AclAction:
    AllowedValues:
    - accept
    - drop
    - log
    Description: 'The action that Cloud Firewall performs on the traffic. Valid values:

      accept: allows the traffic.

      drop: denies the traffic.

      log: monitors the traffic.'
    Type: String
  ApplicationName:
    AllowedValues:
    - ANY
    - FTP
    - HTTP
    - HTTPS
    - MySQL
    - SMTP
    - SMTPS
    - RDP
    - VNC
    - SSH
    - Redis
    - MQTT
    - MongoDB
    - Memcache
    - SSL
    Description: "The application type that the access control policy supports.\n\
      Valid values: \nANY (indicates that all application types are supported) \n\
      FTP \nHTTP \nHTTPS \nMySQL \nSMTP \nSMTPS \nRDP \nVNC \nSSH \nRedis \nMQTT \n\
      MongoDB \nMemcache \nSSL"
    Type: String
  Description:
    Description: The description of the access control policy.
    Type: String
  DestPort:
    Description: 'The destination port in the access control policy.

      Note This parameter must be specified if the DestPortType parameter is set to
      port.'
    Type: String
  DestPortGroup:
    Description: 'The address book of destination ports in the access control policy.

      Note This parameter must be specified if the DestPortType parameter is set to
      group.'
    Type: String
  DestPortType:
    AllowedValues:
    - group
    - port
    Description: 'The type of the destination port in the access control policy. Valid
      values:

      port: port

      group: address book'
    Type: String
  Destination:
    Description: 'The destination address in the access control policy.

      Set this parameter in the following way:

      If the DestinationType parameter is set to net, set the value to a Classless
      Inter-Domain Routing (CIDR) block.

      Example: 10.2.3.0/24.

      If the DestinationType parameter is set to group, set the value to the name
      of an address book.

      Example: db_group.

      If the DestinationType parameter is set to domain, set the value to a domain
      name.

      Example: *.aliyuncs.com.'
    Type: String
  DestinationType:
    AllowedValues:
    - domain
    - group
    - net
    Description: 'The type of the destination address in the access control policy.
      Valid values:

      net: CIDR block

      group: address book

      domain: domain name'
    Type: String
  Lang:
    AllowedValues:
    - en
    - zh
    Description: 'The natural language of the request and response. Valid values:

      zh: Chinese

      en: English'
    Type: String
  NewOrder:
    Description: 'The priority of the access control policy.

      The priority value starts from 1. A smaller priority value indicates a higher
      priority.

      Note The value of -1 indicates the lowest priority.'
    Type: String
  Proto:
    AllowedValues:
    - ANY
    - TCP
    - UDP
    - ICMP
    Description: The type of the security protocol in the access control policy.
    Type: String
  RegionId:
    AllowedValues:
    - cn-hangzhou
    - ap-southeast-1
    Default: cn-hangzhou
    Description: Region ID. Default to cn-hangzhou.
    Type: String
  Source:
    Description: 'The source address in the access control policy.

      If the SourceType parameter is set to net, set the value to a CIDR block. Example:
      10.2.3.0/24.

      If the SourceType parameter is set to group, set the value to the name of an
      address book. Example: db_group.'
    Type: String
  SourceType:
    AllowedValues:
    - group
    - net
    Description: 'The type of the source address in the access control policy. Valid
      values:

      net: CIDR block

      group: address book'
    Type: String
  VpcFirewallId:
    Description: 'The ID of the policy group to which you want to add the access control
      policy.

      If the VPC firewall is used to protect CEN, set the value to the ID of the CEN
      instance

      that the VPC firewall protects. Example: cen-ervw5jbw1234*****.

      If the VPC firewall is used to protect Express Connect, set the value to the
      ID of

      the VPC firewall instance. Example: vfw-a42bbb748c91234*****.

      Note You can call the DescribeVpcFirewallAclGroupList operation to query the
      ID of the policy group.'
    Type: String
Resources:
  VpcFirewallControlPolicy:
    Properties:
      AclAction:
        Ref: AclAction
      ApplicationName:
        Ref: ApplicationName
      Description:
        Ref: Description
      DestPort:
        Ref: DestPort
      DestPortGroup:
        Ref: DestPortGroup
      DestPortType:
        Ref: DestPortType
      Destination:
        Ref: Destination
      DestinationType:
        Ref: DestinationType
      Lang:
        Ref: Lang
      NewOrder:
        Ref: NewOrder
      Proto:
        Ref: Proto
      RegionId:
        Ref: RegionId
      Source:
        Ref: Source
      SourceType:
        Ref: SourceType
      VpcFirewallId:
        Ref: VpcFirewallId
    Type: ALIYUN::CLOUDFW::VpcFirewallControlPolicy
Outputs:
  AclUuid:
    Description: The unique ID of the access control policy.
    Value:
      Fn::GetAtt:
      - VpcFirewallControlPolicy
      - AclUuid

JSON格式

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Parameters": {
    "Destination": {
      "Type": "String",
      "Description": "The destination address in the access control policy.\nSet this parameter in the following way:\nIf the DestinationType parameter is set to net, set the value to a Classless Inter-Domain Routing (CIDR) block.\nExample: 10.2.3.0/24.\nIf the DestinationType parameter is set to group, set the value to the name of an address book.\nExample: db_group.\nIf the DestinationType parameter is set to domain, set the value to a domain name.\nExample: *.aliyuncs.com."
    },
    "ApplicationName": {
      "Type": "String",
      "Description": "The application type that the access control policy supports.\nValid values: \nANY (indicates that all application types are supported) \nFTP \nHTTP \nHTTPS \nMySQL \nSMTP \nSMTPS \nRDP \nVNC \nSSH \nRedis \nMQTT \nMongoDB \nMemcache \nSSL",
      "AllowedValues": [
        "ANY",
        "FTP",
        "HTTP",
        "HTTPS",
        "MySQL",
        "SMTP",
        "SMTPS",
        "RDP",
        "VNC",
        "SSH",
        "Redis",
        "MQTT",
        "MongoDB",
        "Memcache",
        "SSL"
      ]
    },
    "Description": {
      "Type": "String",
      "Description": "The description of the access control policy."
    },
    "SourceType": {
      "Type": "String",
      "Description": "The type of the source address in the access control policy. Valid values:\nnet: CIDR block\ngroup: address book",
      "AllowedValues": [
        "group",
        "net"
      ]
    },
    "DestPort": {
      "Type": "String",
      "Description": "The destination port in the access control policy.\nNote This parameter must be specified if the DestPortType parameter is set to port."
    },
    "AclAction": {
      "Type": "String",
      "Description": "The action that Cloud Firewall performs on the traffic. Valid values:\naccept: allows the traffic.\ndrop: denies the traffic.\nlog: monitors the traffic.",
      "AllowedValues": [
        "accept",
        "drop",
        "log"
      ]
    },
    "Lang": {
      "Type": "String",
      "Description": "The natural language of the request and response. Valid values:\nzh: Chinese\nen: English",
      "AllowedValues": [
        "en",
        "zh"
      ]
    },
    "DestinationType": {
      "Type": "String",
      "Description": "The type of the destination address in the access control policy. Valid values:\nnet: CIDR block\ngroup: address book\ndomain: domain name",
      "AllowedValues": [
        "domain",
        "group",
        "net"
      ]
    },
    "VpcFirewallId": {
      "Type": "String",
      "Description": "The ID of the policy group to which you want to add the access control policy.\nIf the VPC firewall is used to protect CEN, set the value to the ID of the CEN instance\nthat the VPC firewall protects. Example: cen-ervw5jbw1234*****.\nIf the VPC firewall is used to protect Express Connect, set the value to the ID of\nthe VPC firewall instance. Example: vfw-a42bbb748c91234*****.\nNote You can call the DescribeVpcFirewallAclGroupList operation to query the ID of the policy group."
    },
    "Source": {
      "Type": "String",
      "Description": "The source address in the access control policy.\nIf the SourceType parameter is set to net, set the value to a CIDR block. Example: 10.2.3.0/24.\nIf the SourceType parameter is set to group, set the value to the name of an address book. Example: db_group."
    },
    "DestPortType": {
      "Type": "String",
      "Description": "The type of the destination port in the access control policy. Valid values:\nport: port\ngroup: address book",
      "AllowedValues": [
        "group",
        "port"
      ]
    },
    "Proto": {
      "Type": "String",
      "Description": "The type of the security protocol in the access control policy.",
      "AllowedValues": [
        "ANY",
        "TCP",
        "UDP",
        "ICMP"
      ]
    },
    "RegionId": {
      "Type": "String",
      "Description": "Region ID. Default to cn-hangzhou.",
      "AllowedValues": [
        "cn-hangzhou",
        "ap-southeast-1"
      ],
      "Default": "cn-hangzhou"
    },
    "NewOrder": {
      "Type": "String",
      "Description": "The priority of the access control policy.\nThe priority value starts from 1. A smaller priority value indicates a higher priority.\nNote The value of -1 indicates the lowest priority."
    },
    "DestPortGroup": {
      "Type": "String",
      "Description": "The address book of destination ports in the access control policy.\nNote This parameter must be specified if the DestPortType parameter is set to group."
    }
  },
  "Resources": {
    "VpcFirewallControlPolicy": {
      "Type": "ALIYUN::CLOUDFW::VpcFirewallControlPolicy",
      "Properties": {
        "Destination": {
          "Ref": "Destination"
        },
        "ApplicationName": {
          "Ref": "ApplicationName"
        },
        "Description": {
          "Ref": "Description"
        },
        "SourceType": {
          "Ref": "SourceType"
        },
        "DestPort": {
          "Ref": "DestPort"
        },
        "AclAction": {
          "Ref": "AclAction"
        },
        "Lang": {
          "Ref": "Lang"
        },
        "DestinationType": {
          "Ref": "DestinationType"
        },
        "VpcFirewallId": {
          "Ref": "VpcFirewallId"
        },
        "Source": {
          "Ref": "Source"
        },
        "DestPortType": {
          "Ref": "DestPortType"
        },
        "Proto": {
          "Ref": "Proto"
        },
        "RegionId": {
          "Ref": "RegionId"
        },
        "NewOrder": {
          "Ref": "NewOrder"
        },
        "DestPortGroup": {
          "Ref": "DestPortGroup"
        }
      }
    }
  },
  "Outputs": {
    "AclUuid": {
      "Description": "The unique ID of the access control policy.",
      "Value": {
        "Fn::GetAtt": [
          "VpcFirewallControlPolicy",
          "AclUuid"
        ]
      }
    }
  }
}