A Virtual Border Router with BFD On and the Attachment That Makes It Reach a VPC
A virtual border router on a physical connection you already have, with BFD on so a dead circuit is noticed in milliseconds rather than at the BGP hold timer, and an optional Express Connect Router attachment. Without that attachment the circuit terminates at the border router, which looks like a working connection and routes nothing. Sitelink is billed and off.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "express_connect" {
source = "www.iac-bazaar.com/iac-bazaar/alicloud-express-connect/alicloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
alicloud-express-connect
A dedicated interconnect on Alibaba Cloud Express Connect. Works with Terraform and OpenTofu
(>= 1.6), alicloud provider >= 1.0, < 2.0.
A private circuit is a private path, not a private conversation. Traffic crosses Express Connect in clear text through a carrier's equipment, and no argument on this resource changes that.
BFD is off until you set the intervals, and without it a dead circuit is noticed only when the BGP hold timer expires.
Attaching the VBR to an Express Connect Router is what lets it reach a VPC. Without that the circuit terminates at the border router, which looks like a working connection and routes nothing.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
alicloud-cen-transit-router
An Alibaba Cloud CEN instance with an Enterprise Edition transit router, the route tables you name, and a VPC attachment per VPC with an interface per zone (one zone by name), each associated with one route table and propagating into the tables you list. The default route table is never used, so no VPC reaches another until you say so.
alicloud-privatelink-endpoint
An Alibaba Cloud PrivateLink endpoint to a PrivateLink service or an Alibaba Cloud service, with an elastic network interface in each vSwitch you name (one zone has to be accepted by name), behind the security groups you name, and protected from deletion until the protection is turned off.
alicloud-vpc-peering
A peer connection between two VPCs with a route entry written into every route table you list, on both sides, for every CIDR of the other side, because an Activated peering carries nothing until the routes exist. A default route through a peering is refused, and a cross-account peering that the other account has yet to accept has to be taken by name.
alicloud-vpn-gateway
An Alibaba Cloud VPN gateway (pay-as-you-go; subscription by name) with a customer gateway and one IPsec connection on IKEv2 negotiating AES-256, SHA-256 and DH group 14 in both phases, the weak options refused by validation and IKEv1 accepted only by name, dead peer detection and NAT traversal on, and the remote subnets' routes written for you.
alicloud-vpc-foundation
Multi-AZ VPC with vSwitches, NAT gateway, SNAT, security groups, and flow logs.
alicloud-nat-gateway
An enhanced, pay-as-you-go NAT gateway for an existing Alibaba Cloud VPC, with a PayByTraffic elastic IP whose bandwidth cap every subnet shares, and an SNAT entry for each vSwitch listed, because a gateway with no SNAT entry forwards nothing. Deletion protection is on for the gateway and the address; off has to be accepted by name.