# Rule sets are replaced as a whole

ACL rules, security group rules and DNS upstream servers are replaced as a whole. Learn how each command makes you state the full new state, including an empty one.

Network ACL rules, security group rules, route table routes and DNS upstream servers are replaced as a whole set. There is no command to add or remove one rule, and no way to say “leave this part as it is”. Each update writes the complete new state, so each command makes you state that state in full and refuses to run if you leave part of it out.

## What each command needs [#what-each-command-needs]

| Command | State it in full with |
| --- | --- |
| `update-acl-rules` | `--rule …` (repeatable) or `--no-rules` |
| `update-security-group-rules` | `--ingress-rule …` or `--no-ingress-rules`, and `--egress-rule …` or `--no-egress-rules` |
| `create-dns-policy`, `update-dns-policy` | `--upstream-server …` or `--no-upstream-servers`, and `--relay-enabled true` or `false` |
| `update-route-table-routes` | `--route …` (repeatable), including the local routes |
| `create-subnet`, `update-subnet-auto-assign-public-ip` | `--auto-assign-public-ip true` or `false` |

To change one rule, read the current set with the matching `get-` command, then send the whole set with your change.

## The empty set is stated by name [#the-empty-set-is-stated-by-name]

An empty set is a legitimate state. An ACL with no rules denies everything, a security group with no egress rules lets nothing out, and a DNS policy that doesn’t relay needs no upstream servers. You ask for it with its flag, never by leaving an argument out:

- `update-acl-rules --acl-urn <acl-urn>` on its own is refused. Add `--no-rules` if you mean an ACL with no rules.
- `update-security-group-rules` replaces both lists on every call. Giving only `--ingress-rule` is refused, because it would also replace the egress rules. Repeat `--egress-rule` for the rules you keep, or give `--no-egress-rules`.

## Booleans are explicit [#booleans-are-explicit]

`--relay-enabled` and `--auto-assign-public-ip` take `true` or `false` rather than being on when present. Leaving one off an update can’t turn a setting off by accident. A create command takes the same flags as its update command.

## Contradictions are refused [#contradictions-are-refused]

Giving both forms of the same list, such as `--rule …` together with `--no-rules`, is an error. `--relay-enabled true` with `--no-upstream-servers` is refused too, because a relaying policy needs at least one server.

## Related [#related]

- [Security groups](/docs/network/traffic-control/security-groups)
- [Network ACLs](/docs/network/traffic-control/network-acls)
- [Manage DNS policies](/docs/network/dns/manage-policies)
- [Route tables](/docs/network/internet-access/route-tables)