Actions Supported by Identity Policy-based Authorization

IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by Live, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by Live, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for Live.

**Table 1** Actions supported by Live
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
live:statistics:listSnapshotUsage	Grants permission to query the number of snapshots.	List	-	-	-
live:statistics:listSingleStreamDetail	Grants permission to query stream analytics.	Read	-	-	-
live:stream:listLiveStreamsOnline	Grants permission to query online streams.	List	-	-	-
live:statistics:listUpStreamDetail	Grants permission to querying CDN upstream streaming quality data.	Read	-	-	-
live:statistics:queryStreamDisconnectRecord	Grants permission to query stream disconnection records.	Read	-	-	-
live:statistics:listUpTrafficSummary	Grants permission to query the total upstream traffic within a specific time span.	Read	-	-	-
live:statistics:listUpBandwidthPeak	Grants permission to query the upstream bandwidth peak.	Read	-	-	-
live:statistics:ShowUpTraffic	Grants permission to query the upstream traffic.	Read	-	-	-
live:statistics:ListHttpcodeCategory	Grants permission to monitor the status code categorization.	Read	-	-	-
live:statistics:RealTimeDomainDimensionQuery	Grants permission to query content retrieval bandwidth.	Read	-	-	-
live:statistics:DomainBandwidthAndFluxExcel	Grants permission to export the bandwidth details, summary/traffic details, and summary.	Read	-	-	-
live:statistics:listCdnDomainStats	Grants permission to query domain statistics by location.	List	-	-	-
live:statistics:listHttpCodeDimension	Grants permission to query HTTP status codes for pulling streams.	List	-	-	-
live:statistics:listSingleStreamFramerate	Grants permission to query the stream frame rate.	List	-	-	-
live:statistics:listSingleStreamBitrate	Grants permission to query the stream bitrate.	List	-	-	-
live:statistics:listRecordUsage	Grants permission to query the number of recording channels.	List	-	-	-
live:statistics:listStreamCount	Grants permission to query the number of channels by domain name.	List	-	-	-
live:statistics:listHistoryStreams	Grants permission to query historical streams.	List	-	-	-
live:statistics:listStreamPortrait	Grants permission to query playback profile information.	List	-	-	-
live:statistics:listBandwidthDetail	Grants permission to query the playback bandwidth trend.	List	-	-	-
live:statistics:listTrafficDetail	Grants permission to query the playback traffic trend.	List	-	-	-
live:statistics:listDomainBandwidthPeak	Grants permission to query the peak playback bandwidth.	List	-	-	-
live:statistics:listDomainTrafficSummary	Grants permission to query the total playback traffic.	List	-	-	-
live:statistics:listUpBandwidth	Grants permission to query uplink bandwidth.	List	-	-	-
live:statistics:listAreaDetail	Grants permission to query the distribution of indicators in each region.	List	-	-	-
live:statistics:listTranscodeUsage	Grants permission to query the duration of transcoded outputs.	List	-	-	-
live:statistics:listUsersOfStream	Grants permission to query the viewer trend by stream.	List	-	-	-
live:statistics:listBandwidthOfStream	Query the bandwidth trend by stream.	List	-	-	-
live:statistics:listDomainBandwidthDetail	Query the playback bandwidth trend.	List	-	-	-
live:statistics:listDomainTrafficDetail	Query the playback traffic trend.	List	-	-	-
live:statistics:listPushBandwidth	Query real-time upstream bandwidth by domain name.	List	-	-	-
live:statistics:listRealTimeBandwidthOfDomain	Query real-time downstream bandwidth by domain name.	List	-	-	-
live:statistics:listRealTimeDomainBandwidthDetail	Query details about the real-time downstream bandwidth.	List	-	-	-
live:statistics:listRealTimeDomainUserDetail	Query details about the number of online viewers.	List	-	-	-
live:statistics:listRealTimeStreamBandwidth	Query real-time downstream bandwidth by stream.	List	-	-	-
live:statistics:listRealTimeStreamBitrate	Query the real-time stream bitrate.	List	-	-	-
live:statistics:listRealTimeStreamCount	Query the number of online streams.	List	-	-	-
live:statistics:listRealTimeStreamFramerate	Query the real-time stream frame rate.	List	-	-	-
live:statistics:listRealTimeStreamUser	Query the number of online viewers by stream.	List	-	-	-
live:statistics:listRealTimeUsersOfDomain	Query the number of online viewers.	List	-	-	-
live:statistics:listTranscodeConcurrency	Query real-time transcoding routes.	List	-	-	-
live:statistics:listTranscodeTaskCount	Query the number of transcoding tasks.	List	-	-	-
live:domain:createDomain	Grants permission to create a domain name.	Write	-	-	-
live:domain:getDomains	Grants permission to query a domain name.	Read	-	-	-
live:domain:deleteDomain	Grants permission to delete a domain name.	Write	-	-	-
live:domain:updateDomain	Grants permission to modify a domain name.	Write	-	-	-
live:domain:createDomainsMapping	Grants permission to map domain names.	Write	-	-	-
live:domain:deleteDomainsMapping	Grants permission to delete the mapping between domain names.	Write	-	-	-
live:domain:updateStreamNotification	Grants permission to add or modify the configuration of stream status notifications.	Write	-	-	-
live:domain:getStreamNotifications	Grants permission to query the configuration of stream status notifications.	Read	-	-	-
live:domain:deleteStreamNotification	Grants permission to delete the configuration of stream status notifications.	Write	-	-	-
live:domain:createCDNConfig	Grants permission to create domain name configuration items.	Write	-	-	-
live:domain:updateCDNConfig	Grants permission to modify domain name configuration items.	Write	-	-	-
live:domain:getCDNConfig	Grants permission to query domain name configuration items.	Read	-	-	-
live:domain:deleteCDNConfig	Grants permission to delete domain name configuration items.	Write	-	-	-
live:domain:getIPAuthList	Grants permission to query the IP address blacklist or whitelist.	Read	-	-	-
live:domain:updateIPAuthList	Grants permission to modify the IP address blacklist or whitelist.	Write	-	-	-
live:domain:getGeoBlockingList	Grants permission to obtain regions with livestreaming restrictions.	Read	-	-	-
live:domain:updateGeoBlocking	Grants permission to modify regions with livestreaming restrictions.	Write	-	-	-
live:domain:updateRefererChain	Grants permission to set the referer validation blacklist and whitelist.	Write	-	-	-
live:domain:deleteRefererChain	Grants permission to delete the referer validation blacklist and whitelist.	Write	-	-	-
live:domain:getRefererChain	Grants permission to query the referer validation blacklist and whitelist.	Read	-	-	-
live:logs:listLog	Grants permission to obtain the link for downloading playback logs.	Read	-	-	-
live:domain:getCertificates	Grants permission to query HTTPS certificate information.	Read	-	-	-
live:record:createRule	Grants permission to create a recording rule.	Write	-	-	-
live:record:listRules	Grants permission to query recording rules.	Read	-	-	-
live:record:updateRule	Grants permission to modify a recording rule.	Write	-	-	-
live:record:deleteRule	Grants permission to delete a recording rule.	Write	-	-	-
live:record:getRule	Grants permission to query a recording rule.	Read	-	-	-
live:record:listContents	Grants permission to query recordings.	Read	-	-	-
live:record:createCommand	Grants permission to submit a command for controlling recording.	Write	-	-	-
live:record:createCallback	Grants permission to create a recording callback rule.	Write	-	-	-
live:record:listCallbacks	Grants permission to query recording callback rules.	Read	-	-	-
live:record:updateCallback	Grants permission to modify a recording callback rule.	Write	-	-	-
live:record:getCallback	Grants permission to query a recording callback rule.	Read	-	-	-
live:record:deleteCallback	Grants permission to delete a recording callback rule.	Write	-	-	-
live:snapshot:createRule	Grants permission to configure snapshot capture.	Write	-	-	-
live:snapshot:updateRule	Grants permission to modify snapshot capture.	Write	-	-	-
live:snapshot:listRules	Grants permission to query snapshot capture.	Read	-	-	-
live:snapshot:deleteRule	Grants permission to delete snapshot capture.	Write	-	-	-
live:stream:createStreamForbidden	Grants permission to disable a push stream.	Write	-	-	-
live:stream:listStreamForbidden	Grants permission to query disabled streams.	Read	-	-	-
live:stream:deleteStreamForbidden	Grants permission to resume a push stream.	Write	-	-	-
live:stream:updateStreamForbidden	Grants permission to modify the attribute of a disabled stream.	Write	-	-	-
live:stream:createStreamForbiddenOnce	Grants permission to disconnect a stream.	Write	-	-	-
live:stream:createPullTask	Grants permission to create a task for ingesting streams from external networks.	Write	-	-	-
live:stream:deletePullTask	Grants permission to delete a task for ingesting streams from external networks.	Write	-	-	-
live:stream:listPullTask	Grants permission to query a task for ingesting streams from external networks.	Read	-	-	-
live:tenant:updateChargingMode	Grants permission to configure the billing mode.	Write	-	-	-
live:tenant:getTenantInformation	Grants permission to query tenant information.	Read	-	-	-
live:transcode:createTranscodingsTemplate	Grants permission to create a transcoding template.	Write	-	-	-
live:transcode:deleteTranscodingsTemplate	Grants permission to delete a transcoding template.	Write	-	-	-
live:transcode:updateTranscodingsTemplate	Grants permission to modify a transcoding template.	Write	-	-	-
live:transcode:listTranscodingsTemplate	Grants permission to query a transcoding template.	Read	-	-	-
live:transcode:createSEI	Grants permission to add transcoding SEI.	Write	-	-	-

Each API of Live usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by Live APIs
API	Action	Dependencies
GET /v2/{project_id}/stats/snapshot	live:statistics:listSnapshotUsage	-
GET /v2/{project_id}/stats/stream-detail	live:statistics:listSingleStreamDetail	-
GET /v1/{project_id}/realtime/streams	live:stream:listLiveStreamsOnline	-
GET /v2/{project_id}/stats/up-stream/detail	live:statistics:listUpStreamDetail	-
GET /v2/{project_id}/stats/httpcodes	live:statistics:listHttpCodeDimension	-
GET /v2/{project_id}/stats/stream/framerate	live:statistics:listSingleStreamFramerate	-
GET /v2/{project_id}/stats/stream/bitrate	live:statistics:listSingleStreamBitrate	-
GET /v2/{project_id}/stats/record	live:statistics:listRecordUsage	-
GET /v2/{project_id}/stats/stream-count	live:statistics:listStreamCount	-
GET /v2/{project_id}/stats/history/streams	live:statistics:listHistoryStreams	-
GET /v2/{project_id}/stats/stream-portraits	live:statistics:listStreamPortrait	-
GET /v2/{project_id}/stats/bandwidth/detail	live:statistics:listBandwidthDetail	-
GET /v2/{project_id}/stats/traffic/detail	live:statistics:listTrafficDetail	-
GET /v2/{project_id}/stats/bandwidth/peak	live:statistics:listDomainBandwidthPeak	-
GET /v2/{project_id}/stats/traffic/summary	live:statistics:listDomainTrafficSummary	-
GET /v2/{project_id}/stats/up-bandwidth/detail	live:statistics:listUpBandwidth	-
GET /v2/{project_id}/stats/area/detail	live:statistics:listAreaDetail	-
GET /v2/{project_id}/stats/transcode	live:statistics:listTranscodeUsage	-
GET /v2/{project_id}/stats/user	live:statistics:listUsersOfStream	-
POST /v1/{project_id}/domain	live:domain:createDomain	-
DELETE /v1/{project_id}/domain	live:domain:deleteDomain	-
PUT /v1/{project_id}/domain	live:domain:updateDomain	-
GET /v1/{project_id}/domain	live:domain:getDomains	-
PUT /v1/{project_id}/domains_mapping	live:domain:createDomainsMapping	-
DELETE /v1/{project_id}/domains_mapping	live:domain:deleteDomainsMapping	-
PUT /v1/{project_id}/notifications/publish	live:domain:updateStreamNotification	-
GET /v1/{project_id}/notifications/publish	live:domain:getStreamNotifications	-
DELETE /v1/{project_id}/notifications/publish	live:domain:deleteStreamNotification	-
GET /v1/{project_id}/guard/ip	live:domain:getIPAuthList	-
PUT /v1/{project_id}/guard/ip	live:domain:updateIPAuthList	-
PUT /v1/{project_id}/guard/referer-chain	live:domain:updateRefererChain	-
DELETE /v1/{project_id}/guard/referer-chain	live:domain:deleteRefererChain	-
GET /v1/{project_id}/guard/referer-chain	live:domain:getRefererChain	-
GET /v1/{project_id}/logs	live:logs:listLog	-
GET /v2/{project_id}/certificates	live:domain:getCertificates	-
POST /v1/{project_id}/record/rules	live:record:createRule	-
GET /v1/{project_id}/record/rules	live:record:listRules	-
PUT /v1/{project_id}/record/rules/{id}	live:record:updateRule	-
DELETE /v1/{project_id}/record/rules/{id}	live:record:deleteRule	-
GET /v1/{project_id}/record/rules/{id}	live:record:getRule	-
POST /v1/{project_id}/record/control	live:record:createCommand	-
POST /v1/{project_id}/record/callbacks	live:record:createCallback	-
GET /v1/{project_id}/record/callbacks	live:record:listCallbacks	-
PUT /v1/{project_id}/record/callbacks/{id}	live:record:updateCallback	-
GET /v1/{project_id}/record/callbacks/{id}	live:record:getCallback	-
DELETE /v1/{project_id}/record/callbacks/{id}	live:record:deleteCallback	-
POST /v1/{project_id}/stream/snapshot	live:snapshot:createRule	-
PUT /v1/{project_id}/stream/snapshot	live:snapshot:updateRule	-
GET /v1/{project_id}/stream/snapshot	live:snapshot:listRules	-
DELETE /v1/{project_id}/stream/snapshot	live:snapshot:deleteRule	-
POST /v1/{project_id}/stream/blocks	live:stream:createStreamForbidden	-
GET /v1/{project_id}/stream/blocks	live:stream:listStreamForbidden	-
DELETE /v1/{project_id}/stream/blocks	live:stream:deleteStreamForbidden	-
PUT /v1/{project_id}/stream/blocks	live:stream:updateStreamForbidden	-
POST /v1/{project_id}/stream/block-once	live:stream:createStreamForbiddenOnce	-
POST /v1/{project_id}/template/transcodings	live:transcode:createTranscodingsTemplate	-
DELETE /v1/{project_id}/template/transcodings	live:transcode:deleteTranscodingsTemplate	-
PUT /v1/{project_id}/template/transcodings	live:transcode:updateTranscodingsTemplate	-
GET /v1/{project_id}/template/transcodings	live:transcode:listTranscodingsTemplate	-
GET /v1/{project_id}/guard/key-chain	live:domain:getCDNConfig	-
PUT /v1/{project_id}/guard/key-chain	live:domain:updateCDNConfig	-
DELETE /v1/{project_id}/guard/key-chain	live:domain:deleteCDNConfig	-
PUT /v1/{project_id}/guard/https-cert	live:domain:updateCDNConfig	-
GET /v1/{project_id}/guard/https-cert	live:domain:getCDNConfig	-
DELETE /v1/{project_id}/guard/https-cert	live:domain:deleteCDNConfig	-
POST /v1/{project_id}/pull/stream/task	live:stream:createPullTask	-
DELETE /v1/{project_id}/pull/stream/task	live:stream:deletePullTask	-
GET /v1/{project_id}/pull/stream/task	live:stream:listPullTask	-

Resources

Live does not support resource-level authorization. To allow access to Live, use a wildcard (*) in the Resource element of the identity policy, indicating that the identity policy will be applied to all resources.

Conditions

Live does not support service-specific condition keys in identity policies. It can only use global condition keys applicable to all services. For details, see Global Condition Keys.

Parent Topic: Permissions and Supported Actions

Previous topic: Actions Supported by Policy-based Authorization

Next topic: Appendix

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

For any further questions, feel free to contact us through the chatbot.

Chatbot