CreateNetworkAcl - Amazon Elastic Compute Cloud
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).


Creates a network ACL in a VPC. Network ACLs provide an optional layer of security (in addition to security groups) for the instances in your VPC.

For more information, see Network ACLs in the Amazon VPC User Guide.

Request Parameters

The following parameters are for this specific action. For more information about required and optional parameters that are common to all actions, see Common Query Parameters.


Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. For more information, see Ensuring idempotency.

Type: String

Required: No


Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

Type: Boolean

Required: No


The tags to assign to the network ACL.

Type: Array of TagSpecification objects

Required: No


The ID of the VPC.

Type: String

Required: Yes

Response Elements

The following elements are returned by the service.


Unique, case-sensitive identifier to ensure the idempotency of the request. Only returned if a client token was provided in the request.

Type: String


Information about the network ACL.

Type: NetworkAcl object


The ID of the request.

Type: String


For information about the errors that are common to all actions, see Common client error codes.



This example creates a network ACL in the specified IPv6-enabled VPC. The response includes default IPv4 and IPv6 entries for egress and ingress traffic, each with a high rule number. These are the last entries we process to decide whether traffic is allowed in or out of an associated subnet. If the traffic doesn't match any rules with a lower rule number, then these default entries ultimately deny the traffic.

Sample Request &VpcId=vpc-11ad4878 &AUTHPARAMS

Sample Response

<CreateNetworkAclResponse xmlns=""> <requestId>59dbff89-35bd-4eac-99ed-be587EXAMPLE</requestId> <networkAcl> <networkAclId>acl-5fb85d36</networkAclId> <vpcId>vpc-11ad4878</vpcId> <default>false</default> <entrySet> <item> <ruleNumber>32767</ruleNumber> <protocol>all</protocol> <ruleAction>deny</ruleAction> <egress>true</egress> <cidrBlock></cidrBlock> </item> <item> <ruleNumber>32767</ruleNumber> <protocol>all</protocol> <ruleAction>deny</ruleAction> <egress>false</egress> <cidrBlock></cidrBlock> </item> <item> <ruleNumber>32768</ruleNumber> <protocol>all</protocol> <ruleAction>deny</ruleAction> <egress>true</egress> <ipv6CidrBlock>::/0</ipv6CidrBlock> </item> <item> <ruleNumber>32768</ruleNumber> <protocol>all</protocol> <ruleAction>deny</ruleAction> <egress>false</egress> <ipv6CidrBlock>::/0</ipv6CidrBlock> </item> </entrySet> <associationSet/> <tagSet/> </networkAcl> </CreateNetworkAclResponse>

See Also

For more information about using this API in one of the language-specific Amazon SDKs, see the following: