Help Center/ Live/ Service Overview/ Permissions Management
Updated on 2024-08-05 GMT+08:00

Permissions Management

If you need to assign different permissions to employees in your enterprise to access your Live resources, Identity and Access Management (IAM) is a good choice for refined permissions management. IAM provides identity authentication, permissions management, and access control to ensure secure access to your Huawei Cloud resources.

With IAM, you can use your Huawei Cloud account to create IAM users, and assign permissions to the users to control their access to specific resources. For example, some software developers in your enterprise need to use Live but are not allowed to delete Live resources or perform any high-risk operations. To this end, you can create IAM users for the software developers and assign them only the permissions for using Live.

If your Huawei Cloud account does not require individual IAM users for permissions management, skip this section.

IAM is free. You pay only for the resources in your account.

Live Permissions

By default, new IAM users do not have any permissions. You need to add them to one or more groups, and then add permissions policies or roles to these groups. The users inherit permissions from their groups and can then perform specified operations on cloud services.

Live is a project-level service deployed in different physical regions. To assign permissions to a user group, specify the scope as region-specific projects and select projects for the permissions to take effect. If All projects is selected, the permissions will take effect for the user group in all region-specific projects. When accessing Live, the users need to switch to a region where they have been authorized to use Live.

When assigning permissions to a user group in IAM, you cannot select Enterprise projects when setting Specify the authorization scope on the Select Scope page.

You can assign users permissions by using roles and policies.

  • Roles: A coarse-grained authorization mechanism provided by IAM to define permissions based on users' job responsibilities. This mechanism provides a limited number of service-level roles for authorization. If one role has a dependency role required for accessing Live, assign both roles to the users. However, roles are not an ideal choice for fine-grained authorization and secure access control.
  • Policies: Policy-based permissions management is a type of fine-grained authorization mechanism that grants permissions for performing operations on specific cloud resources. This mechanism allows for more flexible policy-based authorization and meets secure access control requirements. For example, you can assign Live users the permissions for managing only a certain type of resources.

Table 1 lists all system-defined permissions on Live.

  • If you use a custom policy but do not use the system-defined permissions Live FullAccess and Live ReadOnlyAccess, you need to add the operation permission live:tenant:getTenantInformation before accessing the Live console.
  • After assigning an IAM user the Live FullAccess permission, you need to assign the user the following Cloud Eye permissions to monitor metrics of Live:
    • CES ReadOnlyAccess: On the Cloud Eye console, choose Cloud Service Monitoring > Live to view resource monitoring metrics of Live.
    • CES FullAccess: On the Cloud Eye console, choose Cloud Service Monitoring > Live to view resource monitoring metrics of Live and perform operations.
Table 1 System-defined permissions on Live

Name

Description

Category

Dependency

Live FullAccess

Has all permissions on Live.

System-defined policy

None

Live ReadOnlyAccess

Has the read-only permission on Live.

System-defined policy

None

Table 2 lists the common operations supported by each system-defined policy of Live. Select the policies as required.

Table 2 Common operations supported by each system-defined policy

Operation

Live FullAccess

Live ReadOnlyAccess

Creating a domain name

x

Modifying a domain name

x

Deleting a domain name

x

Querying domain names

Mapping domain names

x

Deleting a domain name mapping

x

Adding or overwriting stream notification configurations

x

Querying stream notification configurations

Deleting stream notification configurations

x

Creating a domain name configuration item

x

Modifying a domain name configuration item

x

Querying domain name configuration items

Deleting a domain name configuration item

x

Querying IP ACLs

Modifying an IP ACL

x

Obtaining the list of regions where Live is available

Modifying the list of regions where Live is available

x

Configuring a referer validation ACL

x

Deleting a referer validation ACL

x

Querying referer validation ACLs

Querying HTTPS certificate information

Obtaining the link for downloading playback logs

Creating a recording template

x

Querying recording templates

Modifying a recording template

x

Deleting a recording template

x

Querying recording templates

Querying recorded content

Submitting a recording command

x

Creating a recording callback

x

Querying recording callbacks

Modifying a recording callback

x

Querying recording callbacks

Deleting a recording callback

x

Configuring a snapshot capturing template

x

Modifying a snapshot capturing template

x

Querying snapshot capturing templates

Deleting a snapshot capturing template

x

Disabling a stream

x

Querying disabled streams

Resuming a stream

x

Modifying the attribute of a disabled stream

x

Disconnecting a stream

x

Querying ongoing streams

Creating a task for ingesting streams from external networks

x

Deleting a task for ingesting streams from external networks

x

Querying tasks for ingesting streams from external networks

Configuring the billing mode

x

Querying tenant information

Creating a transcoding template

x

Deleting a transcoding template

x

Modifying a transcoding template

x

Querying transcoding templates

Adding transcoding SEI

x

Querying HTTP status codes for pulling streams

Querying the stream frame rate

Querying the stream bitrate

Querying the real-time stream bitrate

Querying the real-time stream frame rate

Querying the duration of recordings

Querying the number of snapshots

Querying the number of streams by domain name

Querying historical streams

Querying playback profiles

Querying the number of online streamers

Querying the playback bandwidth trend

Querying the playback traffic trend

Querying the peak playback bandwidth

Querying the total playback traffic

Querying the upstream bandwidth

Querying the distribution of metrics in each region

Querying the playback bandwidth trend

Querying the playback traffic trend

Querying the real-time upstream bandwidth

Querying the real-time downstream bandwidth

Querying the real-time stream bandwidth

Querying details about the real-time downstream bandwidth

Querying the bandwidth trend by stream

Querying the duration of transcoded outputs

Querying the number of transcoding tasks

Querying the number of streams for real-time transcoding

Querying the viewer trend by stream

Querying the number of online viewers by stream

Querying the number of online viewers

Querying details about the number of online viewers

Live FullAccess Policy

{
        "Version": "1.1",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "live:*:*"
                        ]
                }
        ]
}

Live ReadOnlyAccess Policy

{
        "Version": "1.1",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Action": [
                                "live:*:get*",
                                "live:*:list*"
                        ]
                }
        ]
}