ReplaceNetworkAclAssociation - Amazon Elastic Compute Cloud


Changes which network ACL a subnet is associated with. By default when you create a subnet, it's automatically associated with the default network ACL. For more information, see Network ACLs in the Amazon VPC User Guide.

This is an idempotent operation.

Request Parameters

The following parameters are for this specific action. For more information about required and optional parameters that are common to all actions, see Common Query Parameters.


The ID of the current association between the original network ACL and the subnet.

Type: String

Required: Yes


Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

Type: Boolean

Required: No


The ID of the new network ACL to associate with the subnet.

Type: String

Required: Yes

Response Elements

The following elements are returned by the service.


The ID of the new association.

Type: String


The ID of the request.

Type: String


For information about the errors that are common to all actions, see Common client error codes.



This example starts with a network ACL associated with a subnet, and a corresponding association ID aclassoc-e5b95c8c. You want to associate a different network ACL (acl-5fb85d36) with the subnet. The result is a new association ID representing the new association.

Sample Request &AssociationId=aclassoc-e5b95c8c &NetworkAclId=acl-5fb85d36 &AUTHPARAMS

Sample Response

<ReplaceNetworkAclAssociationResponse xmlns=""> <requestId>59dbff89-35bd-4eac-99ed-be587EXAMPLE</requestId> <newAssociationId>aclassoc-17b85d7e</newAssociationId> </ReplaceNetworkAclAssociationResponse>

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: