Media Processing Center (MPC)

IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by MPC, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by MPC, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for MPC.

**Table 1** Actions supported by MPC
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
mpc:transcodeTemplate:create	Grants permission to create a transcoding template.	Write	-	-	-
mpc:transcodeTemplate:update	Grants permission to modify a custom transcoding template.	Write	-	-	-
mpc:transcodeTemplate:delete	Grants permission to delete a custom transcoding template.	Write	-	-	-
mpc:transcodeTemplate:view	Grants permission to queries one or more custom transcoding templates.	List	-	-	-
mpc:templateGroup:create	Grants permission to create a transcoding template group.	Write	-	-	-
mpc:templateGroup:view	Grants permission to query one or more custom transcoding template groups.	Write	-	-	-
mpc:templateGroup:update	Grants permission to modify a custom transcoding template group.	Write	-	-	-
mpc:templateGroup:delete	Grants permission to delete a custom transcoding template group.	Write	-	-	-
mpc:watermarkTempate:create	Grants permission to Creates a custom watermark template.	Write	-	-	-
mpc:watermarkTempate:update	Grants permission to modify a watermark template.	Write	-	-	-
mpc:watermarkTempate:delete	Grants permission to delete a watermark template.	Write	-	-	-
mpc:watermarkTempate:view	Grants permission to query one or more custom watermark templates.	List	-	-	-
mpc:transcodeTask:create	Grants permission to create a transcoding task.	Write	-	-	-
mpc:transcodeTask:delete	Grants permission to cancel a transcoding task.	Write	-	-	-
mpc:transcodeTask:view	Grants permission to query one or more transcoding tasks.	Read	-	-	-
mpc:transcodeTask:deleteRecord	Grants permission to deletes transcoding task records.	Write	-	-	-
mpc:transcodeTask:viewSummaryStatistics	Grants permission to queries the task duration statistics.	List	-	-	-
mpc:remuxTsk:create	Grants permission to create a packaging task.	Write	-	-	-
mpc:remuxTsk:retry	Grants permission to retry a failed packaging task.	Write	-	-	-
mpc:remuxTsk:view	Grants permission to query one or more packaging tasks.	List	-	-	-
mpc:remuxTsk:delete	Grants permission to cancel a packaging task.	Write	-	-	-
mpc:remuxTsk:deleteRecord	Grants permission to deletes packaging task records.	Write	-	-	-
mpc:animatedGraphicsTask:create	Grants permission to create an animated GIF task.	Write	-	-	-
mpc:animatedGraphicsTask:view	Grants permission to query one or more animated GIF tasks.	List	-	-	-
mpc:animatedGraphicsTask:delete	Grants permission to cancel an animated GIF task.	Write	-	-	-
mpc:extracTask:create	Grants permission to create a task to parse the metadata of a video file.	Write	-	-	-
mpc:extracTask:view	Grants permission to query the status and results of one or more video parsing tasks.	List	-	-	-
mpc:extracTask:delete	Grants permission to cancel a video parsing task.	Write	-	-	-
mpc:thumbnailsTask:view	Grants permission to query one or more snapshot tasks.	List	-	-	-
mpc:thumbnailsTask:delete	Grants permission to cancel a snapshot task.	Write	-	-	-
mpc:notification:config	Grants permission to configures event notifications on the transcoding server.	Write	-	-	-
mpc:notification:view	Grants permission to queries the enabling statuses of subscription events.	List	-	-	-
mpc:notifyEvent:view	Grants permission to queries all subscription events of an SMN topic.	List	-	-	-
mpc:bucket:view	Grants permission to queries the list of buckets in a specified region.	List	-	-	-
mpc:bucket:updateAuthorized	Grants permission to authorizes MPC to access OBS buckets or cancels the authorization.	Write	-	-	-
mpc:bucketObject:view	Grants permission to queries objects in a bucket.	List	-	-	-
mpc:ageniesTask:create	Grants permission to enables or disables OBS Authorization.	Write	-	-	-
mpc:ageniesTask:view	Grants permission to queries the status of creating an OBS authorization task.	Read	-	-	-

Each API of MPC usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by MPC APIs
API	Action	Dependencies
POST /v1/{project_id}/template/transcodings	mpc:transcodeTemplate:create	-
PUT /v1/{project_id}/template/transcodings	mpc:transcodeTemplate:update	-
DELETE /v1/{project_id}/template/transcodings	mpc:transcodeTemplate:delete	-
GET /v1/{project_id}/template/transcodings	mpc:transcodeTemplate:view	-
POST /v1/{project_id}/template_group/transcodings	mpc:templateGroup:create	-
GET /v1/{project_id}/template_group/transcodings	mpc:templateGroup:view	-
PUT /v1/{project_id}/template_group/transcodings	mpc:templateGroup:update	-
DELETE /v1/{project_id}/template_group/transcodings	mpc:templateGroup:delete	-
POST /v1/{project_id}/template/watermark	mpc:watermarkTempate:create	-
PUT /v1/{project_id}/template/watermark	mpc:watermarkTempate:update	-
DELETE /v1/{project_id}/template/watermark	mpc:watermarkTempate:delete	-
GET /v1/{project_id}/template/watermark	mpc:watermarkTempate:view	-
POST /v1/{project_id}/transcodings	mpc:transcodeTask:create	-
DELETE /v1/{project_id}/transcodings	mpc:transcodeTask:delete	-
GET /v1/{project_id}/transcodings	mpc:transcodeTask:view	-
DELETE /v1/{project_id}/transcodings/task	mpc:transcodeTask:deleteRecord	-
GET /v1/{project_id}/transcodings/summaries	mpc:transcodeTask:viewSummaryStatistics	-
POST /v1/{project_id}/remux	mpc:remuxTsk:create	-
PUT /v1/{project_id}/remux	mpc:remuxTsk:retry	-
GET /v1/{project_id}/remux	mpc:remuxTsk:view	-
DELETE /v1/{project_id}/remux	mpc:remuxTsk:delete	-
DELETE /v1/{project_id}/remux/task	mpc:remuxTsk:deleteRecord	-
POST /v1/{project_id}/animated-graphics	mpc:animatedGraphicsTask:create	-
GET /v1/{project_id}/animated-graphics	mpc:animatedGraphicsTask:view	-
DELETE /v1/{project_id}/animated-graphics	mpc:animatedGraphicsTask:delete	-
POST /v1/{project_id}/extract-metadata	mpc:extracTask:create	-
GET /v1/{project_id}/extract-metadata	mpc:extracTask:view	-
DELETE /v1/{project_id}/extract-metadata	mpc:extracTask:delete	-
POST /v1/{project_id}/thumbnails	mpc:thumbnailsTask:create	-
GET /v1/{project_id}/thumbnails	mpc:thumbnailsTask:view	-
DELETE /v1/{project_id}/thumbnails	mpc:thumbnailsTask:delete	-
PUT /v1/{project_id}/notification	mpc:notification:config	-
GET /v1/{project_id}/notification	mpc:notification:view	-
GET /v1/{project_id}/notification/event	mpc:notifyEvent:view	-
GET /v1/{project_id}/buckets	mpc:bucket:view	-
PUT /v1/{project_id}/authority	mpc:bucket:updateAuthorized	-
GET /v1.0-ext/{project_id}/objects	mpc:bucketObject:view	-
POST /v1/{project_id}/agencies	mpc:ageniesTask:create	-
GET /v1/{project_id}/agencies	mpc:ageniesTask:view	-

Resources

MPC does not support resource-level authorization. To allow access to MPC, use a wildcard (*) in the Resource element of the identity policy, indicating that the identity policy will be applied to all resources.

Conditions

MPC does not support service-specific condition keys in identity policies.It can only use global condition keys applicable to all services. For details, see Global Condition Keys.

Parent topic: Media Services

Previous topic: Live (Live)

Next topic: Management & Governance