SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsaliyun-vpc-manage

aliyun-vpc-manage

Deployment & operations

View repository

Updated 10-15 17:34

About this skill

Category: service

Virtual Private Cloud (VPC)

Validation

mkdir -p output/aliyun-vpc-manage
for f in skills/network/vpc/aliyun-vpc-manage/scripts/*.py; do
  python3 -m py_compile "$f"
done
echo "py_compile_ok" > output/aliyun-vpc-manage/validate.txt

Pass criteria: command exits 0 and output/aliyun-vpc-manage/validate.txt is generated.

Output And Evidence

  • Save list/summarize outputs under output/aliyun-vpc-manage/.
  • Keep command arguments and region scope in each evidence file.

Use Alibaba Cloud OpenAPI (RPC) with official SDKs or OpenAPI Explorer to manage VPC resources. Prefer the Python SDK for all examples and execution.

Prerequisites

pip install alibabacloud_vpc20160428 alibabacloud_tea_openapi alibabacloud_credentials
  • Prepare AccessKey (RAM user/role with least privilege).
  • Choose the correct region and endpoint (public/VPC).
  • VPC OpenAPI is RPC style; prefer SDK or OpenAPI Explorer to avoid manual signing.

API behavior notes (from VPC docs)

  • DescribeVpcs and DescribeVSwitches support pagination via PageNumber + PageSize.
  • DescribeVpcs requires RegionId in the request.
  • CreateVpc returns VpcId immediately but VPC enters Pending status; poll with DescribeVpcs until Available.
  • CreateVSwitch requires an existing VPC in Available status and a valid ZoneId.
  • DeleteVpc fails if VPC still has VSwitches, security groups, or other resources attached.
  • DeleteVSwitch fails if VSwitch still has ECS instances or other resources.

Workflow

  1. Confirm region, resource identifiers, and desired action.
  2. Find API group and exact operation name in references/api_overview.md.
  3. Call API with Python SDK (preferred) or OpenAPI Explorer.
  4. Verify results with describe/list APIs.
  5. If you need repeatable inventory or summaries, use scripts/ and write outputs under output/aliyun-vpc-manage/.

SDK priority

  1. Python SDK (preferred)
  2. OpenAPI Explorer
  3. Other SDKs (only if Python is not feasible)

Python SDK quickstart (list VPCs)

Virtual environment is recommended (avoid PEP 668 system install restrictions).

python3 -m venv .venv
. .venv/bin/activate
pip install alibabacloud_vpc20160428 alibabacloud_tea_openapi alibabacloud_credentials

from alibabacloud_vpc20160428.client import Client as Vpc20160428Client
from alibabacloud_vpc20160428 import models as vpc_models
from alibabacloud_tea_openapi import models as open_api_models


def create_client(region_id: str) -> Vpc20160428Client:
    config = open_api_models.Config(
        region_id=region_id,
        endpoint=f"vpc.{region_id}.aliyuncs.com",
    )
    return Vpc20160428Client(config)


def list_vpcs(region_id: str):
    client = create_client(region_id)
    resp = client.describe_vpcs(vpc_models.DescribeVpcsRequest(
        region_id=region_id,
        page_number=1,
        page_size=50,
    ))
    for v in resp.body.vpcs.vpc:
        print(v.vpc_id, v.vpc_name, v.cidr_block, v.status)


if __name__ == "__main__":
    list_vpcs("cn-hangzhou")

Python SDK scripts (recommended for inventory)

  • List VPCs in a region: scripts/list_vpcs.py
  • List VSwitches in a region: scripts/list_vswitches.py
  • Create a VPC: scripts/create_vpc.py
  • Create a VSwitch: scripts/create_vswitch.py
  • Delete a VPC: scripts/delete_vpc.py
  • Delete a VSwitch: scripts/delete_vswitch.py
  • Query available zones: scripts/describe_zones.py

VPC Network Planning and Design Principles

CIDR Address Planning

  • Each region's business VPC uses an independent /16 CIDR blockto avoid CIDR conflicts during cross-region interconnection. Recommended allocation method:
Region Recommended CIDR
cn-hangzhou 10.1.0.0/16
cn-shanghai 10.2.0.0/16
ap-southeast-1 10.3.0.0/16
cn-beijing 10.4.0.0/16
More regions 10.5~254.0.0/16
  • Do not use an overly large CIDR(such as 10.0.0.0/8), even if the VSwitch only uses a small portion. A large CIDR block will prevent interconnection with other 10.x CIDR block VPCs through CEN.
  • VSwitch uniformly uses /24(252 available IPs), which is sufficient for most businesses. If a single availability zone needs a large number of instances, you can use /20 (4092 IPs).
  • Reserve CIDR block intervalsfor future expansion. For example, use 0-9 for the application layer, 10-19 for the database layer, and 20-29 for middleware.

Availability Zones and High Availability

  • Production environments should cover at least 2~3 availability zones, with at least 1 VSwitch in each availability zone.
  • The application layer and data layer are distributed across different availability zonesto ensure that services are not interrupted when a single AZ fails.
  • Before creating a VSwitch, use scripts/describe_zones.py to query the availability zone list. Availability zone numbers differ by region.

VSwitch Tiered Isolation

Segment VSwitches by business function to facilitate network isolation through ACLs and security groups:

10.x.0~9.0/24    → 应用层（Web/API 服务器）
10.x.10~19.0/24  → 数据层（RDS、Redis、MongoDB）
10.x.20~29.0/24  → 中间件（MQ、ES、Nacos）
10.x.30~39.0/24  → 管理层（跳板机、运维工具）

VSwitch Naming Conventions

Recommended format:vsw-{region简写}-{可用区}-{用途}

Example:vsw-sg-a-app、vsw-hz-h-db、vsw-sh-e-middleware

Cross-Region Interconnection (CEN)

  • The CIDRs of VPCs that need to be interconnected must not overlap。
  • Automatically generated VPCs (such as those created by the FC component) usually use 10.0.0.0/8，Do not add them to CEN, otherwise they will conflict with the 10.x CIDR block in other regions.
  • When planning business VPCs, consider CEN interconnection requirements in advance and use non-overlapping /16 CIDR blocks from the start.

Common Pitfalls

Problem Cause Solution
CEN attachment fails, reporting a CIDR conflict Two VPCs use overlapping CIDRs Use non-overlapping /16 CIDR blocks for new VPCs
DeleteVpc fails The VPC still contains resources such as VSwitches/security groups/NAT Delete all sub-resources first, then delete the VPC
DeleteVSwitch fails The VSwitch still contains instances such as ECS/RDS Release or migrate the instances first
Creating a VSwitch reports an invalid ZoneId The availability zone is not supported or is sold out Use describe_zones.py to query valid availability zones
Using the default VPC for production The default VPC CIDR block is uncontrollable, and it cannot be reasonably interconnected with other VPCs Always create a new VPC for production environments and plan the CIDR well

Common operation mapping

  • VPC lifecycle: CreateVpc, DeleteVpc, ModifyVpcAttribute
  • VPC query: DescribeVpcs, DescribeVpcAttribute
  • VSwitch lifecycle: CreateVSwitch, DeleteVSwitch, ModifyVSwitchAttribute
  • VSwitch query: DescribeVSwitches, DescribeVSwitchAttributes
  • Route tables: CreateRouteTable, DeleteRouteTable, DescribeRouteTables, CreateRouteEntry, DeleteRouteEntry
  • NAT Gateway: CreateNatGateway, DeleteNatGateway, DescribeNatGateways
  • EIP: AllocateEipAddress, AssociateEipAddress, UnassociateEipAddress, ReleaseEipAddress, DescribeEipAddresses
  • Tags: TagResources, UntagResources, ListTagResources

Query patterns

  • List VPCs: DescribeVpcs (supports filters: VpcId, VpcName, IsDefault, ResourceGroupId)
  • List VSwitches: DescribeVSwitches (supports filters: VpcId, VSwitchId, ZoneId, VSwitchName, IsDefault)
  • Available zones: use ECS DescribeZones API to find valid zones for VSwitch creation

AccessKey priority (must follow, align with README)

  1. Environment variables: ALIBABACLOUD_ACCESS_KEY_ID / ALIBABACLOUD_ACCESS_KEY_SECRET / ALIBABACLOUD_REGION_ID Region policy: ALIBABACLOUD_REGION_ID is an optional default. If unset, decide the most reasonable region for the task; if unclear, ask the user.
  2. Shared config file: ~/.alibabacloud/credentials (region still from env)

Auth setup (README-aligned)

Environment variables:

export ALIBABACLOUD_ACCESS_KEY_ID="your-ak"
export ALIBABACLOUD_ACCESS_KEY_SECRET="your-sk"
export ALIBABACLOUD_REGION_ID="cn-hangzhou"

Also supported by the Alibaba Cloud SDKs:

export ALIBABA_CLOUD_ACCESS_KEY_ID="your-ak"
export ALIBABA_CLOUD_ACCESS_KEY_SECRET="your-sk"

Legacy compatibility:

export ALICLOUD_ACCESS_KEY_ID="your-ak"
export ALICLOUD_ACCESS_KEY_SECRET="your-sk"

Shared config file:

~/.alibabacloud/credentials

[default]
type = access_key
access_key_id = your-ak
access_key_secret = your-sk

API discovery

  • Product code: Vpc
  • Default API version: 2016-04-28
  • Use OpenAPI metadata endpoints to list APIs and get schemas (see references).

Output policy

If you need to save responses or generated artifacts, write them under: output/aliyun-vpc-manage/

References

  • API overview: references/api_overview.md
  • Sources: references/sources.md