Docs

Transit Router

Instance sharing

Cross-account Management overview

Overview

Transit Router (TR) supports attaching cross-account network instances such as Virtual Private Clouds (VPCs), VPN Connects, Direct Connect (DC) Gateways, and TRs to enable private interconnection between the TR and the network instance.

Cross-account network instance attachment: With the instance sharing feature, share a TR instance in my account with any other account or enterprise organization. This enables mutual access between TR instances within my account and another account's network instance (such as VPC, VPN, and DC Gateway) via the TR.

Share with any account: The Owner can share resources with any root user. If the Owner belongs to an enterprise organization, resources can also be shared with the entire enterprise organization, departments, or member accounts.

Share within an enterprise organization: The Owner must be an administrator of the enterprise organization, and can only share resources with this organization and its organizational units or member accounts.

Cross-account peering attachment: Includes cross-account inter-region attachments. You don't need to share your local TR instance. Create it directly using the peer Account ID and TR Instance ID; creation completes once the peer TR authorizes it.

Related terms

Applicable resources	Term	Description
Cross-account network instance attachment	Resource Sharing	VolcanoEngine Resource Management offers cross-account resource sharing capabilities. Learn more
		Owner	The account that initiates resource sharing and owns shared resources. The Owner can share resources with specified accounts or enterprise organizations.
		Shared User	The account that benefits from resource sharing and uses shared resources. The Shared User can choose to accept or reject the sharing invitation.
		Shared Unit	An entity for Resource Sharing. A shared unit can contain multiple shared resources in the same region.
		Shared Resources	Resource instances to be shared, such as TR instances.
		Share Policy	Grant the Shared User permissions to manage shared resources. After sharing the TR with other accounts, the operating permissions granted to the Shared User are system-defined and cannot be modified by default. For details, see Instructions.
		Sharing Invitation	The request that the Shared User receives when the Owner shares resources with it.
		Cross-account Network Instance Attachment	The network instance attached to the TR is a VPC, VPN or DC Gateway whose account is different from the TR account.
Cross-account peering attachment	Cross-account Peering Attachment	A connection is established between two TRs, with each TR belonging to a separate account.
		Cross-account Attachment	The network instance attached to a TR belongs to another account. The cross-account attachment includes cross-account network instance attachments and cross-account peering attachments. Cross-account attachment: When creating a cross-account attachment, the Shared User can associate only VPCs, IPsec-VPN connections, or DC Gateways under my account. Cross-account peering attachment: When creating a cross-account peering attachment, both TR instances must not be shared instances.
		Sharer Account	The account that creates a cross-account peering attachment.
		Recipient Account	The peer account specified when creating a cross-account peering attachment.

Billing notes

The account that creates a cross-account network instance attachment is the Shared User, and bears the attachment fee and traffic processing fee generated by the attachment.

Cross-account inter-region attachment: Both accounts can add to the bandwidth package in my account. The bandwidth package fee is borne by the account that creates it (the shared user).

Instructions

Cross-account network instance attachment

After sharing a TR instance with other accounts or within an enterprise organization, the Owner and the Shared User have different specific actions on the TR instance and the cross-account attachments created by the Shared User within the shared TR instance. The details are shown in the table below.

tip

In the table, a checkmark (✓) denotes supported, a cross (×) denotes not supported, and a dash (--) denotes not applicable.

Actions			Owner	Shared User
Share a TR instance	Modify name of a TR instance	✓	×
		Modify description of a TR instance tip The modified description only applies to my account.	✓	✓
		Modify a TR instance tag	✓	✓
		View TR instance details	✓ tip Support viewing this TR instance and all of its associated TR resources.	✓ tip Support viewing only this TR instance and its associated cross-account attachments.
		Delete a TR instance	✓	×
		All actions related to TR route tables	✓	×
		Create/Delete a shared unit	✓	×
		Accept/Reject sharing invitation	×	✓
Cross-account network instance attachment	Create a cross-account network instance attachment	--	✓
		Modify name of a cross-account network instance attachment	×	✓
		Modify description of a cross-account network instance attachment tip The modified description only applies to my account.	✓	✓
		Edit attachment point for a cross-account VPC attachment	×	✓
		Delete a cross-account network instance attachment	✓	✓
		Enable/Disable auto publishing	×	✓
		Enable/Disable IPv6	×	✓

Cross-account peering attachment

You can create a cross-account peering attachment from either TR instance on both ends. Once a cross-account peering attachment is established, the allowed actions vary depending on the TR account. These differences are detailed in the table below.

tip

In the table, a checkmark (✓) denotes supported, a cross (×) denotes not supported, and a dash (--) denotes not applicable.

Actions	Sharer account	Recipient account
Accept/reject a cross-account peering attachment	×	✓
Modify the name and description of the cross-account peering attachment tip The modified name and description only apply to my account.	✓	✓
Add to bandwidth package tip Bandwidth packages enable cross-region connectivity. Local peer attachments do not require bandwidth packages. You can only add attachments to bandwidth packages under my account. After adding to a bandwidth package, only the account that owns the bandwidth package can modify bandwidth or disassociate the package.	✓	✓
All actions related to routes within my account, including association forwarding, route learning, static routing, route policies, and forwarding policies.	✓	✓
Actions related to QoS management within my account, including traffic marking policies and traffic queue policies.	✓	✓
Delete a cross-account peering attachment tip When the cross-account peering attachment is unavailable, the Recipient account cannot delete the cross-account peering.	✓	✓
Actions related to flow logs	✓	×

Limits

The Owner can share a single TR instance with up to 10 Shared Users by default. A single account can accept up to 10 shared TRs in a single region by default. If the default quota cannot meet your requirements, access the Quota Center to adjust.

The Owner cannot delete a TR instance that is currently being shared. The shared unit must be deleted first.

Shared TR instances do not support cross-account multicast.

The Owner can only select subnets under my account when configuring multicast.

The Shared User cannot configure multicast.

When creating a cross-account peering attachment, both TR instances must not be shared instances.

Usage process

Cross-account network instance attachment

TRs support sharing with any account and sharing within an enterprise organization.

Share TR with any account
Share TR within an enterprise organization
Create a TR instance (Owner)
Initiate TR sharing (Owner)
Accept a sharing invitation (Shared User)
Create a cross-account network instance attachment (Shared User)
Configure enterprise organization (Enterprise Admin)
Create a TR instance (Owner)
Initiate TR sharing (Owner)
Accept a sharing invitation (Shared User)
Create a cross-account network instance attachment

Cross-account peering attachment

Create a cross-account peering attachment: Depending on whether the TR instances on both ends are in the same region, see Creating an inter-region attachment.

Accept a cross-account peering attachment: Use the Recipient account to accept a cross-account attachment and complete authorization for the Sharer account.

Last updated: 2026.09.01 11:37:16