Permissions Management

If you need to assign different permissions to employees in your enterprise to access your Live resources, Identity and Access Management (IAM) is a good choice for refined permissions management. IAM provides identity authentication, permissions management, and access control to ensure secure access to your Huawei Cloud resources.

With IAM, you can use your Huawei Cloud account to create IAM users, and assign permissions to the users to control their access to specific resources. For example, some software developers in your enterprise need to use Live but are not allowed to delete Live resources or perform any high-risk operations. To this end, you can create IAM users for the software developers and assign them only the permissions for using Live.

If your Huawei Cloud account does not require individual IAM users for permissions management, skip this section.

IAM is free. You pay only for the resources in your account.

Live Permissions

By default, new IAM users do not have any permissions. You need to add them to one or more groups, and then add permissions policies or roles to these groups. The users inherit permissions from their groups and can then perform specified operations on cloud services.

Live is a project-level service deployed in different physical regions. To assign permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing Live, the users need to switch to a region where they have been authorized to use Live.

When assigning permissions to a user group in IAM, you cannot select Enterprise projects when setting Specify the authorization scope on the Select Scope page.

You can assign users permissions by using roles and policies.

Roles: A coarse-grained authorization mechanism provided by IAM to define permissions based on users' job responsibilities. This mechanism provides a limited number of service-level roles for authorization. If one role has a dependency role required for accessing Live, assign both roles to the users. However, roles are not an ideal choice for fine-grained authorization and secure access control.
Policies: Policy-based permissions management is a type of fine-grained authorization mechanism that grants permissions for performing operations on specific cloud resources. This mechanism allows for more flexible policy-based authorization and meets secure access control requirements. For example, you can assign Live users the permissions for managing only a certain type of resources.

Table 1 lists all system-defined permissions on Live.

If you use a custom policy but do not use the system-defined permissions Live FullAccess and Live ReadOnlyAccess, you need to add the operation permission live:tenant:getTenantInformation before accessing the Live console.
After assigning an IAM user the Live FullAccess permission, you need to assign the user the following Cloud Eye permissions to monitor metrics of Live:
- CES ReadOnlyAccess: On the Cloud Eye console, choose Cloud Service Monitoring > Live to view resource monitoring metrics of Live.
- CES FullAccess: On the Cloud Eye console, choose Cloud Service Monitoring > Live to view resource monitoring metrics of Live and perform operations.

**Table 1** System-defined permissions on Live
Name	Description	Category	Dependency
Live FullAccess	Has all permissions on Live.	System-defined policy	None
Live ReadOnlyAccess	Has the read-only permission on Live.	System-defined policy	None

Table 2 lists the common operations supported by each system-defined policy of Live. Select the policies as required.

**Table 2** Common operations supported by each system-defined policy
Operation	Live FullAccess	Live ReadOnlyAccess
Creating a domain name	√	x
Modifying a domain name	√	x
Deleting a domain name	√	x
Querying domain names	√	√
Mapping domain names	√	x
Deleting a domain name mapping	√	x
Adding or overwriting stream notification configurations	√	x
Querying stream notification configurations	√	√
Deleting stream notification configurations	√	x
Creating a domain name configuration item	√	x
Modifying a domain name configuration item	√	x
Querying domain name configuration items	√	√
Deleting a domain name configuration item	√	x
Querying IP ACLs	√	√
Modifying an IP ACL	√	x
Obtaining the list of regions where Live is available	√	√
Modifying the list of regions where Live is available	√	x
Configuring a referer validation ACL	√	x
Deleting a referer validation ACL	√	x
Querying referer validation ACLs	√	√
Querying HTTPS certificate information	√	√
Obtaining the link for downloading playback logs	√	√
Creating a recording template	√	x
Querying recording templates	√	√
Modifying a recording template	√	x
Deleting a recording template	√	x
Querying recording templates	√	√
Querying recorded content	√	√
Submitting a recording command	√	x
Creating a recording callback	√	x
Querying recording callbacks	√	√
Modifying a recording callback	√	x
Querying recording callbacks	√	√
Deleting a recording callback	√	x
Configuring a snapshot capturing template	√	x
Modifying a snapshot capturing template	√	x
Querying snapshot capturing templates	√	√
Deleting a snapshot capturing template	√	x
Disabling a stream	√	x
Querying disabled streams	√	√
Resuming a stream	√	x
Modifying the attribute of a disabled stream	√	x
Disconnecting a stream	√	x
Querying ongoing streams	√	√
Creating a task for ingesting streams from external networks	√	x
Deleting a task for ingesting streams from external networks	√	x
Querying tasks for ingesting streams from external networks	√	√
Configuring the billing mode	√	x
Querying tenant information	√	√
Creating a transcoding template	√	x
Deleting a transcoding template	√	x
Modifying a transcoding template	√	x
Querying transcoding templates	√	√
Adding transcoding SEI	√	x
Querying HTTP status codes for pulling streams	√	√
Querying the stream frame rate	√	√
Querying the stream bitrate	√	√
Querying the real-time stream bitrate	√	√
Querying the real-time stream frame rate	√	√
Querying the duration of recordings	√	√
Querying the number of snapshots	√	√
Querying the number of streams by domain name	√	√
Querying historical streams	√	√
Querying playback profiles	√	√
Querying the number of online streamers	√	√
Querying the playback bandwidth trend	√	√
Querying the playback traffic trend	√	√
Querying the peak playback bandwidth	√	√
Querying the total playback traffic	√	√
Querying the upstream bandwidth	√	√
Querying the distribution of metrics in each region	√	√
Querying the playback bandwidth trend	√	√
Querying the playback traffic trend	√	√
Querying the real-time upstream bandwidth	√	√
Querying the real-time downstream bandwidth	√	√
Querying the real-time stream bandwidth	√	√
Querying details about the real-time downstream bandwidth	√	√
Querying the bandwidth trend by stream	√	√
Querying the duration of transcoded outputs	√	√
Querying the number of transcoding tasks	√	√
Querying the number of streams for real-time transcoding	√	√
Querying the viewer trend by stream	√	√
Querying the number of online viewers by stream	√	√
Querying the number of online viewers	√	√
Querying details about the number of online viewers	√	√

Helpful Links

IAM Service Overview
Creating a User and Assigning Live Permissions

Live FullAccess Policy

{
        "Version": "1.1",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "live:*:*"
                        ]
                }
        ]
}

Live ReadOnlyAccess Policy

{
        "Version": "1.1",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "live:*:get*",
                                "live:*:list*"
                        ]
                }
        ]
}

Previous topic: Related Services

Next topic: Regions and AZs