Actions Supported by Identity Policy-based Authorization

IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by VOD, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by VOD, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for VOD.

**Table 1** Actions supported by VOD
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
vod:asset:publishFromObs	Grants permission to publish media from OBS with one click.	Write	-	-	-
vod:asset:checkDuplication	Grants permission to upload file MD5.	Read	-	-	-
vod:asset:createExtractAudioTask	Grants permission to extract audio from video media assets.	Write	vod *	vod:AssetLabel	-
vod:asset:createPackagingRelation	Grants permission to associate media assets with real-time transcoding configurations.	Write	vod *	vod:AssetLabel	-
vod:asset:createProcessTask	Grants permission to process media.	Write	vod *	vod:AssetLabel	-
vod:asset:createRefreshTask	Grants permission to refresh CDN.	Write	vod *	vod:AssetLabel	-
vod:asset:createUploadTaskByUrl	Grants permission to create media assets via URL pull method.	Write	vod *	-	-
vod:asset:delete	Grants permission to delete media.	Write	vod *	-	-
vod:asset:deleteProcessTask	Grants permission to cancel media transcoding tasks.	Write	vod *	vod:AssetLabel	-
vod:asset:deleteTranscodeProduct	Grants permission to delete transcoding outputs.	Write	vod *	vod:AssetLabel	-
vod:asset:deleteUploadTaskByUrl	Grants permission to delete URL pull tasks.	Write	vod *	-	-
vod:asset:getCiphers	Grants permission to query keys.	Read	vod *	vod:AssetLabel	-
vod:asset:getDetails	Grants permission to query detailed information of specified media.	Read	vod *	vod:AssetLabel	-
vod:asset:getInfo	Grants permission to query media information.	List	vod *	-	-
vod:asset:getPreheatTask	Grants permission to query CDN preheating.	Read	-	-	-
vod:asset:getRefreshTask	Grants permission to query CDN refresh.	Read	-	-	-
vod:asset:getShieldInfo	Grants permission to query media asset blocking information.	Read	vod *	vod:AssetLabel	-
vod:asset:getTaskInfo	Grants permission to list asset task info.	List	vod *	-	-
vod:asset:getUploadTaskByUrl	Grants permission to query URL pull tasks.	List	vod *	-	-
vod:asset:list	Grants permission to query media list.	List	vod *	-	-
vod:asset:listAuthUrl	Grants permission to obtain playback URLs with authentication information.	List	-	-	-
vod:asset:modifyInfo	Grants permission to update media information.	Write	vod *	vod:AssetLabel	-
vod:asset:preheat	Grants permission to preheat CDN.	Write	-	-	-
vod:asset:publish	Grants permission to publish media.	Write	vod *	-	-
vod:asset:retrievalUploadTaskByUrl	Grants permission to restore URL pull tasks.	Write	vod *	-	-
vod:asset:review	Grants permission to create media asset review tasks.	Write	vod *	vod:AssetLabel	-
vod:asset:shield	Grants permission to block media assets.	Write	vod *	vod:AssetLabel	-
vod:asset:stopExtractAudioTask	Grants permission to cancel audio extraction tasks.	Write	-	-	-
vod:asset:stopUploadTaskByUrl	Grants permission to cancel URL pull tasks.	Write	vod *	-	-
vod:asset:unpublish	Grants permission to cancel media release.	Write	vod *	-	-
vod:asset:update	Grants permission to update media.	Write	vod *	vod:AssetLabel	-
vod:asset:updateStorageMode	Grants permission to modify media asset file storage mode in OBS.	Write	vod *	vod:AssetLabel	-
vod:asset:upload	Grants permission to confirm media upload.	Write	vod *	-	-
vod:bucket:authority	Grants permission to bucket authorization.	Write	-	-	-
vod:bucket:list	Grants permission to query bucket lists.	List	-	-	-
vod:category:create	Grants permission to create media asset categories.	Write	-	-	-
vod:category:delete	Grants permission to delete media asset categories.	Write	-	-	-
vod:category:list	Grants permission to query media asset category information lists.	List	-	-	-
vod:category:update	Grants permission to modify media asset categories.	Write	-	-	-
vod:cdnBill:get	Grants permission to query CDN billing methods.	Read	-	-	-
vod:cdnBill:update	Grants permission to set CDN billing methods.	Write	-	-	-
vod:domain:create	Grants permission to create CDN domain names.	Write	-	-	-
vod:domain:delete	Grants permission to delete CDN domain names.	Write	-	-	-
vod:domain:disable	Grants permission to disable CDN domain names.	Write	-	-	-
vod:domain:enable	Grants permission to enable CDN domain names.	Write	-	-	-
vod:domain:getHttpsSetting	Grants permission to configure HTTPS.	Read	-	-	-
vod:domain:getIpv6Config	Grants permission to configure the domain name IPv6 switch.	Read	-	-	-
vod:domain:getRefererGuard	Grants permission to query playback anti-hotlinking configuration.	Read	-	-	-
vod:domain:getUrlAuthGuard	Grants permission to query URL authentication configuration.	Read	-	-	-
vod:domain:list	Grants permission to query CDN domain names.	List	-	-	-
vod:domain:modifyHttpsSetting	Grants permission to configure HTTPS.	Write	-	-	-
vod:domain:modifyRefererGuard	Grants permission to set playback anti-hotlinking for a single domain.	Write	-	-	-
vod:domain:modifyUrlAuthGuard	Grants permission to set URL authentication configuration.	Write	-	-	-
vod:domain:update	Grants permission to modify CDN domain names.	Write	-	-	-
vod:domain:updateIpv6Config	Grants permission to configure the domain name IPv6 switch.	Write	-	-	-
vod:drm-template:create	Grants permission to create a DRM template.	Write	-	-	-
vod:drm-template:delete	Grants permission to delete DRM template information.	Write	-	-	-
vod:drm-template:list	Grants permission to retrieve DRM template information.	List	-	-	-
vod:encryptionConfigurations:get	Grants permission to query key retrieval addresses.	Read	-	-	-
vod:encryptionConfigurations:update	Grants permission to set key retrieval addresses.	Write	-	-	-
vod:enterpriseProject:list	Grants permission to query the list of authorized enterprise projects.	List	-	-	-
vod:increment:create	Grants permission to create incremental audio and video hosting configurations.	Write	-	-	-
vod:increment:delete	Grants permission to delete incremental audio and video hosting configurations.	Write	-	-	-
vod:increment:get	Grants permission to query incremental audio and video hosting configurations.	Read	-	-	-
vod:increment:update	Grants permission to modify incremental audio and video hosting configurations.	Write	-	-	-
vod:log:get	Grants permission to query CDN logs.	Read	-	-	-
vod:log:getDailySummary	Grants permission to query media daily playback statistics.	Read	-	-	-
vod:notification:get	Grants permission to query on-demand service server event notifications.	Read	-	-	-
vod:notification:update	Grants permission to configure on-demand service server event notifications.	Write	-	-	-
vod:object:list	Grants permission to query objects in buckets.	List	-	-	-
vod:packagingConfigurations:create	Grants permission to add a single real-time trans-encoding configuration.	Write	-	-	-
vod:packagingConfigurations:delete	Grants permission to delete a single real-time transcoding configuration.	Write	-	-	-
vod:packagingConfigurations:get	Grants permission to query details of a single configuration list.	Read	-	-	-
vod:packagingConfigurations:list	Grants permission to query the real-time transcoding configuration list.	List	-	-	-
vod:packagingGroup:create	Grants permission to create real-time trans-encoding configuration groups.	Write	-	-	-
vod:packagingGroup:delete	Grants permission to delete real-time trans-encoding configuration groups.	Write	-	-	-
vod:packagingGroup:list	Grants permission to query real-time trans-encoding configuration group lists.	List	-	-	-
vod:packagingGroup:update	Grants permission to modify real-time trans-encoding configuration groups.	Write	-	-	-
vod:reviewTemplate:create	Grants permission to create custom review templates.	Write	-	-	-
vod:reviewTemplate:delete	Grants permission to delete custom review templates.	Write	-	-	-
vod:reviewTemplate:list	Grants permission to query review template lists.	List	-	-	-
vod:reviewTemplate:update	Grants permission to modify review templates.	Write	-	-	-
vod:statistics:get	Grants permission to query CDN data information for a domain.	Read	-	-	-
vod:stock:get	Grants permission to query hosting task details.	Read	-	-	-
vod:stock:getAssetInfo	Grants permission to query details of hosted media.	Read	-	-	-
vod:stock:list	Grants permission to query output paths.	List	-	-	-
vod:storageModeType:get	Grants permission to query media asset cooling configurations.	Read	-	-	-
vod:storageModeType:update	Grants permission to modify media asset cooling granularity.	Write	-	-	-
vod:storagePolicy:create	Grants permission to create a cooling-down policy.	Write	-	-	-
vod:storagePolicy:delete	Grants permission to delete media asset cooling-down policies.	Write	-	-	-
vod:storagePolicy:list	Grants permission to query media asset cooling-down policies.	List	-	-	-
vod:storagePolicy:update	Grants permission to modify media asset cooling-down policies.	Write	-	-	-
vod:subtitles:update	Grants permission to multi-subtitle package.	Write	-	-	-
vod:templateCollection:create	Grants permission to create a custom template group collection.	Write	-	-	-
vod:templateCollection:delete	Grants permission to delete a custom template group collection.	Write	-	-	-
vod:templateCollection:list	Grants permission to query a custom template group collection.	List	-	-	-
vod:templateCollection:update	Grants permission to modify a custom template group collection.	Write	-	-	-
vod:templateGroup:create	Grants permission to create custom transcoding template groups.	Write	-	-	-
vod:templateGroup:delete	Grants permission to delete custom transcoding template groups.	Write	-	-	-
vod:templateGroup:list	Grants permission to query the list of transcoding template groups.	List	-	-	-
vod:templateGroup:update	Grants permission to modify transcoding template groups.	Write	-	-	-
vod:tenantInfo:update	Grants permission to modify tenant information.	Write	-	-	-
vod:watermark:create	Grants permission to enable watermarking.	Write	-	-	-
vod:watermarkTemplate:create	Grants permission to create watermark templates.	Write	-	-	-
vod:watermarkTemplate:delete	Grants permission to delete watermark templates.	Write	-	-	-
vod:watermarkTemplate:list	Grants permission to query watermark lists.	List	-	-	-
vod:watermarkTemplate:update	Grants permission to modify watermark templates.	Write	-	-	-
vod:workflow:create	Grants permission to create workflows.	Write	-	-	-
vod:workflow:delete	Grants permission to delete workflows.	Write	-	-	-
vod:workflow:get	Grants permission to query workflow details.	Read	-	-	-
vod:workflow:list	Grants permission to query the workflow list.	List	-	-	-
vod:workflow:update	Grants permission to modify workflows.	Write	-	-	-
vod:workflowTask:create	Grants permission to execute workflow tasks.	Write	-	-	-
vod:workflowTask:getDetails	Grants permission to query workflow task details.	Read	-	-	-
vod:workflowTask:list	Grants permission to query the workflow task list.	List	-	-	-

Each API of VOD usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by VOD APIs
API	Action	Dependencies
-	vod:asset:review	-
-	vod:bucket:authority	obs:bucket:deleteBucketPolicy obs:bucket:getBucketPolicy obs:bucket:putBucketPolicy
DELETE /v1.0/{project_id}/asset/process	vod:asset:deleteProcessTask	-
DELETE /v1.0/{project_id}/asset/extract_audio	vod:asset:stopExtractAudioTask	-
-	vod:asset:checkDuplication	-
GET /v1.0/{project_id}/asset/duplication	vod:asset:checkDuplication	-
-	vod:domain:updateIpv6Config	-
-	vod:domain:modifyHttpsSetting	scm:cert:export scm:cert:get
POST /v1.0/{project_id}/asset/status/uploaded	vod:asset:upload	-
-	vod:asset:upload	-
POST /v1.0/{project_id}/watermark/status/uploaded	vod:watermarkTemplate:create	-
POST /v1.0/{project_id}/asset	vod:asset:upload	-
POST /v1.0/{project_id}/asset/category	vod:category:create	-
POST /v1.0/{project_id}/asset/process	vod:asset:createProcessTask	-
POST /v1.0/{project_id}/asset/review	vod:asset:review	-
-	vod:category:create	-
-	vod:domain:create	eps:enterpriseProjects:list
-	vod:domain:modifyUrlAuthGuard	-
-	vod:drm-template:create	-
POST /v1.0/{project_id}/asset/extract_audio	vod:asset:createExtractAudioTask	-
-	vod:increment:create	obs:bucket:getBucketPolicy obs:bucket:listBucket
-	vod:packagingConfigurations:create	-
-	vod:packagingGroup:create	-
POST /v1.0/{project_id}/asset/preheating	vod:asset:preheat	-
-	vod:reviewTemplate:create	-
-	vod:storagePolicy:create	-
-	vod:templateGroup:create	-
POST /v1.0/{project_id}/asset/template-collection/transcodings	vod:templateCollection:create	-
POST /v2/{project_id}/asset/template/transcodings	vod:templateGroup:create	-
POST /v1.0/{project_id}/template/watermark	vod:watermarkTemplate:create	-
-	vod:workflow:create	-
DELETE /v1.0/{project_id}/asset/category	vod:category:delete	-
-	vod:asset:deleteProcessTask	-
DELETE /v1.0/{project_id}/asset	vod:asset:delete	-
-	vod:category:delete	-
-	vod:domain:delete	-
-	vod:drm-template:delete	-
-	vod:asset:stopExtractAudioTask	-
-	vod:increment:delete	obs:bucket:putBucketNotification
-	vod:packagingConfigurations:delete	-
-	vod:packagingGroup:delete	-
-	vod:reviewTemplate:delete	-
-	vod:storagePolicy:delete	-
-	vod:templateGroup:delete	-
DELETE /v1.0/{project_id}/asset/template-collection/transcodings	vod:templateCollection:delete	-
DELETE /v1/{project_id}/asset/transcode-product	vod:asset:deleteTranscodeProduct	-
DELETE /v2/{project_id}/asset/template/transcodings	vod:templateGroup:delete	-
-	vod:asset:deleteUploadTaskByUrl	-
DELETE /v1.0/{project_id}/template/watermark	vod:watermarkTemplate:delete	-
-	vod:workflow:delete	-
-	vod:domain:disable	-
-	vod:domain:enable	-
-	vod:watermark:create	-
-	vod:asset:createExtractAudioTask	-
-	vod:log:getDailySummary	-
-	vod:asset:listAuthUrl	-
-	vod:asset:listAuthUrl	-
-	vod:asset:getCiphers	-
-	vod:drm-template:list	-
-	vod:encryptionConfigurations:get	-
GET /v1.0/{project_id}/asset/category	vod:category:list	-
GET /v1/{project_id}/asset/daily-summary	vod:log:getDailySummary	-
GET /v1.0/{project_id}/asset/list	vod:asset:list	-
GET /v1/{project_id}/asset/tasks	vod:asset:getTaskInfo	-
GET /v2/{project_id}/asset/categories	vod:category:list	-
GET /v1.0/{project_id}/vod/cdn/logs	vod:log:get	-
-	vod:storagePolicy:list	-
-	vod:templateGroup:list	-
GET /v1.0/{project_id}/asset/template-collection/transcodings	vod:templateCollection:list	-
GET /v1.0/{project_id}/asset/top-statistics	vod:statistics:get	-
GET /v2/{project_id}/asset/template/transcodings	vod:templateGroup:list	-
GET /v1.0/{project_id}/template/watermark	vod:watermarkTemplate:list	-
-	vod:category:update	-
-	vod:domain:update	-
-	vod:increment:update	obs:bucket:getBucketPolicy obs:bucket:listBucket
-	vod:domain:modifyRefererGuard	-
PUT /v1/{project_id}/asset/subtitles	vod:subtitles:update	-
-	vod:workflow:update	-
-	vod:notification:update	-
-	vod:asset:createPackagingRelation	-
-	vod:asset:preheat	-
-	vod:asset:createProcessTask	-
POST /v1.0/{project_id}/asset/reproduction	vod:asset:publishFromObs	obs:bucket:getBucketAcl obs:bucket:putBucketAcl
POST /v1.0/{project_id}/asset/status/publish	vod:asset:publish	-
-	vod:bucket:list	obs:bucket:getBucketPolicy obs:bucket:listBucket
-	vod:object:list	obs:object:getObject
-	vod:asset:getDetails	-
-	vod:asset:list	-
-	vod:asset:getInfo	-
-	vod:asset:upload	-
-	vod:category:list	-
-	vod:cdnBill:get	-
-	vod:statistics:get	-
-	vod:statistics:get	-
-	vod:domain:list	eps:enterpriseProjects:list
-	vod:domain:getUrlAuthGuard	-
-	vod:log:get	-
-	vod:enterpriseProject:list	eps:enterpriseProjects:list
-	vod:increment:get	obs:bucket:listBucket
-	vod:domain:getHttpsSetting	-
-	vod:notification:get	-
-	vod:notification:get	-
-	vod:packagingConfigurations:list	-
-	vod:packagingConfigurations:get	-
-	vod:packagingGroup:list	-
-	vod:asset:getPreheatTask	-
-	vod:domain:getRefererGuard	-
-	vod:asset:list	-
-	vod:asset:unpublish	-
-	vod:reviewTemplate:list	-
-	vod:asset:getShieldInfo	-
-	vod:stock:getAssetInfo	-
-	vod:stock:list	-
-	vod:stock:get	-
-	vod:templateGroup:list	-
-	vod:statistics:get	-
-	vod:asset:getUploadTaskByUrl	-
-	vod:statistics:get	-
-	vod:statistics:get	-
-	vod:watermarkTemplate:list	-
-	vod:watermarkTemplate:list	-
-	vod:workflow:get	-
-	vod:workflow:list	-
-	vod:workflowTask:getDetails	-
-	vod:workflowTask:list	-
POST /v1/{project_id}/asset/refresh	vod:asset:createRefreshTask	-
-	vod:asset:retrievalUploadTaskByUrl	-
-	vod:cdnBill:update	-
-	vod:encryptionConfigurations:update	-
-	vod:tenantInfo:update	-
-	vod:asset:shield	-
GET /v1.0/{project_id}/asset/ciphers	vod:asset:getCiphers	-
GET /v1.0/{project_id}/asset/details	vod:asset:getDetails	-
GET /v1.0/{project_id}/asset/info	vod:asset:getInfo	-
GET /v1.1/{project_id}/asset/authority	vod:asset:upload	-
GET /v1.0/{project_id}/asset/cdn-statistics	vod:statistics:get	-
-	vod:domain:getHttpsSetting	scm:cert:list
-	vod:domain:getIpv6Config	-
GET /v1.0/{project_id}/asset/preheating	vod:asset:getPreheatTask	-
GET /v1/{project_id}/asset/refresh	vod:asset:getRefreshTask	-
GET /v1/{project_id}/asset/storage-mode-type	vod:storageModeType:get	-
GET /v1/{project_id}/asset/vod-retrieval	vod:statistics:get	-
GET /v1.0/{project_id}/asset/vod-statistics	vod:statistics:get	-
-	vod:workflowTask:create	-
-	vod:asset:stopUploadTaskByUrl	-
-	vod:subtitles:update	-
POST /v1.0/{project_id}/asset/status/unpublish	vod:asset:unpublish	-
PUT /v1.0/{project_id}/asset	vod:asset:update	-
PUT /v1.0/{project_id}/asset/category	vod:category:update	-
PUT /v1.0/{project_id}/asset/info	vod:asset:modifyInfo	-
PUT /v1.0/{project_id}/asset/authority	vod:bucket:authority	obs:bucket:deleteBucketPolicy obs:bucket:getBucketPolicy obs:bucket:putBucketPolicy
PUT /v1.0/{project_id}/asset/cover	vod:asset:update	-
-	vod:packagingGroup:update	-
-	vod:reviewTemplate:update	-
PUT /v1/{project_id}/asset/storage-mode	vod:asset:updateStorageMode	-
PUT /v1/{project_id}/asset/storage-mode-type	vod:storageModeType:update	-
-	vod:storagePolicy:update	-
-	vod:templateGroup:update	-
PUT /v1.0/{project_id}/asset/template-collection/transcodings	vod:templateCollection:update	-
PUT /v2/{project_id}/asset/template/transcodings	vod:templateGroup:update	-
-	vod:watermarkTemplate:update	-
PUT /v1.0/{project_id}/template/watermark	vod:watermarkTemplate:update	-
-	vod:asset:update	-
POST /v1.0/{project_id}/asset/upload_by_url	vod:asset:createUploadTaskByUrl	obs:bucket:getBucketAcl obs:bucket:putBucketAcl
-	vod:asset:upload	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for VOD.

**Table 3** Resource types supported by VOD
Resource Type	URN
vod	vod:<region>:<account-id>:assets:<asset-id>

Conditions

Condition Key Overview

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, vod) apply only to operations of the xx service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see operators.

Service-specific condition keys supported by VOD

The following table lists the condition keys that you can define in identity policies for VOD. You can include these condition keys to specify conditions for when your identity policy is in effect.