All Products
Search
Document Center

:ModifyFirewallRules

Last Updated:Sep 17, 2025

Modifies the configuration of the SQL firewall.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

  • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

  • API: The API that you can call to perform the action.

  • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

  • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

    • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

    • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

  • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

  • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

polardb:ModifyFirewallRules

update

*DBCluster

acs:polardb:{#regionId}:{#accountId}:{#resource-type}/{#resource-id}

 None None

Request parameters

Parameter

Type

Required

Description

Example
DBClusterId

string

Yes

The cluster ID.

pc-*****************

RuleName

string

Yes

The name of the firewall rule. You can specify only one rule name at a time.

Note

  • Call the DescribeFirewallRules operation to query the details of all firewall rules for the target cluster, including the rule names.

  • If the specified rule name does not exist in the current cluster, the system automatically creates a new firewall rule based on the rule name and the value of RuleConfig.

test
RuleConfig

string

Yes

A JSON string that contains the configuration parameters of the firewall rule to modify and their values. The parameter values are strings. Example: { "id": "test", "enabled": "true", "mode": "Defending", "users": { "applies_to": [] }, "endpoint": "[{"EndpointName":"pe-***************","EndpointType":"Cluster","DBEndpointDescription":"Cluster Endpoint"},{"EndpointName":"pe-***************","EndpointType":"Custom","DBEndpointDescription":"pc-***************"},{"EndpointName":"pe-***************","EndpointType":"Custom","DBEndpointDescription":"pc-***************"}]", "type": "BlackList", "sub_rules": [] }, "RuleName": "test" }. The parameters are described as follows:

  • "id": Required. The name of the firewall rule.

  • "databases": Optional. The names of the databases to which the rule applies. You can specify multiple database names. Separate the names with commas (,). If you leave this parameter empty, the rule applies to all databases in the cluster.

  • "tables": Optional. The names of the tables to which the rule applies. You can specify multiple table names. Separate the names with commas (,). If you leave this parameter empty, the rule applies to all tables in the cluster.

  • "columns": Required. The names of the fields to which the rule applies. You can specify multiple field names. Separate the names with commas (,).

  • "description": Optional. The description of the data masking rule. The description can be up to 64 characters in length.

  • "enabled": Required. Specifies whether to enable or disable the data masking rule. Valid values: true (enable) and false (disable).

  • "applies_to": The names of the database accounts to which the rule applies. You can specify multiple database account names. Separate the names with commas (,).

  • "exempted": The names of the database accounts to which the rule does not apply. You can specify multiple database account names. Separate the names with commas (,).

Note

  • If you specify the RuleName parameter, the RuleConfig parameter is required.

  • You must specify either "applies_to" or "exempted".

{"id":"test","enabled":"true","mode":"Collecting","users":{"applies_to":[]},"endpoint":"[{"EndpointName":"pe-************","EndpointType":"Cluster","DBEndpointDescription":"Cluster Address"},{"EndpointName":"pe-************","EndpointType":"Custom","DBEndpointDescription":"pc-************"},{"EndpointName":"pe-************","EndpointType":"Custom","DBEndpointDescription":"pc-************K"}]","type":"WhiteList"}

Response elements

Element

Type

Description

Example

object

Schema of Response

RequestId

string

Id of the request

A8DBA3A7-82FB-5CBE-A002-8959E47D1D61
Message

string

The returned message.

Note

If the request is successful, Successful is returned. If the request fails, an error message is returned, such as an error code.

Successful
Success

boolean

The result of the request. Valid values:

  • true: The request is successful.

  • false: The request fails.

true

Examples

Success response

JSON format

{ "RequestId": "A8DBA3A7-82FB-5CBE-A002-8959E47D1D61", "Message": "Successful", "Success": true }

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.