Actions Supported by Policy-based Authorization

This section describes the VOD actions supported by policy-based authorization.

Supported Actions

xx (cloud service name) provides system-defined policies that can be directly used in IAM. You can also create custom policies to supplement system-defined policies for more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

Permissions: statements in a policy that allow or deny certain operations
APIs: REST APIs that can be called by a user who has been granted specific permissions.
Actions: specific operations that are allowed or denied in a custom policy.
Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow any existing action dependencies for that user.
IAM projects/Enterprise projects: the authorization scope of a custom policy. A custom policy can be applied to IAM projects or enterprise projects or both. Policies that contain actions for both IAM and enterprise projects can be used and applied for both IAM and Enterprise Management. Policies that contain actions only for IAM projects can be used and applied to IAM only. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. For details about the differences between IAM and enterprise management, see Differences Between IAM and Enterprise Management.

When assigning permissions to a user group in IAM, you cannot select Enterprise projects when setting Specify the authorization scope on the Select Scope page.

VOD supports the following actions that can be defined in custom policies.

**Table 1** VOD actions that can be defined in custom policies
Permission	API	Action	IAM (Project)	Enterprise Project
Uploading a media asset	POST /v1.0/{project_id}/asset	vod:asset:upload	√	×
Authorizing access to an OBS bucket	PUT /v1.0/{project_id}/asset/authority	vod:bucket:authority	√	×
Dumping media assets to VOD	POST /v1.0/{project_id}/asset/reproduction	vod:asset:publishFromObs	√	×
Creating a URL pull task	POST /v1.0/{project_id}/asset/upload_by_url	vod:asset:createUploadTaskByUrl	√	×
Updating a video	PUT /v1.0/{project_id}/asset	vod:asset:update	√	×
Creating a media asset processing task	POST /v1.0/{project_id}/asset/process	vod:asset:createProcessTask	√	×
Canceling a media asset processing task	DELETE /v1.0/{project_id}/asset/process	vod:asset:deleteProcessTask	√	×
Creating an audio extraction task	POST /v1.0/{project_id}/asset/extract_audio	vod:asset:createExtractAudioTask	√	×
Canceling an audio extraction task	DELETE /v1.0/{project_id}/asset/extract_audio	vod:asset:stopExtractAudioTask	√	×
Reviewing a media asset	POST /v1.0/{project_id}/asset/review	vod:asset:review	√	×
Deleting a media asset	DELETE /v1.0/{project_id}/asset	vod:asset:delete	√	×
Publishing a media asset	POST /v1.0/{project_id}/asset/status/publish	vod:asset:publish	√	×
Canceling media asset publish	POST /v1.0/{project_id}/asset/status/unpublish	vod:asset:unpublish	√	×
Querying media asset information	GET /v1.0/{project_id}/asset/info	vod:asset:getInfo	√	×
Modifying a media asset attribute	PUT /v1.0/{project_id}/asset/info	vod:asset:modifyInfo	√	×
Querying media asset details	GET /v1.0/{project_id}/asset/details	vod:asset:getDetails	√	×
Querying media assets	GET /v1.0/{project_id}/asset/list	vod:asset:list	√	×
Creating a pre-loading task	POST /v1.0/{project_id}/asset/preheating	vod:asset:preheat	√	×
Querying a pre-loading task	GET /v1.0/{project_id}/asset/preheating	vod:asset:getPreheatTask	√	×
Creating a CDN cache refreshing task	POST /v1/{project_id}/asset/refresh	vod:asset:createRefreshTask	√	×
Querying CDN cache refreshing tasks	GET /v1/{project_id}/asset/refresh	vod:asset:getRefreshTask	√	×
Creating a media asset category	POST /v1.0/{project_id}/asset/category	vod:category:create	√	×
Modifying a media asset category	PUT /v1.0/{project_id}/asset/category	vod:category:update	√	×
Deleting a media asset category	DELETE /v1.0/{project_id}/asset/category	vod:category:delete	√	×
Querying media asset categories	GET /v1.0/{project_id}/asset/category	vod:category:list	√	×
Querying media asset keys	GET /v1.0/{project_id}/asset/ciphers	vod:asset:getCiphers	√	×
Querying statistics	GET /v1.0/{project_id}/asset/cdn-statistics GET /v1.0/{project_id}/asset/vod-statistics GET /v1.0/{project_id}/asset/top-statistics	vod:statistics:get	√	×
Querying CDN logs	GET /v1.0/{project_id}/vod/cdn/logs	vod:log:get	√	×
Querying daily playback statistics	GET /v1/{project_id}/asset/daily-summary	vod:log:getDailySummary	√	×
Creating a watermark template	POST /v1.0/{project_id}/template/watermark	vod:watermarkTemplate:create	√	×
Modifying a watermark template	PUT /v1.0/{project_id}/template/watermark	vod:watermarkTemplate:update	√	×
Querying watermark templates	GET /v1.0/{project_id}/template/watermark	vod:watermarkTemplate:list	√	×
Deleting a watermark template	DELETE /v1.0/{project_id}/template/watermark	vod:watermarkTemplate:delete	√	×
Updating subtitles	PUT /v1/{project_id}/asset/subtitles	vod:subtitles:update	√	×
Creating a custom template group	POST /v2/{project_id}/asset/template/transcodings	vod:templateGroup:create	√	×
Querying custom template groups	GET /v2/{project_id}/asset/template/transcodings	vod:templateGroup:list	√	×
Modifying a custom template group	PUT /v2/{project_id}/asset/template/transcodings	vod:templateGroup:update	√	×
Deleting a custom template group	DELETE /v2/{project_id}/asset/template/transcodings	vod:templateGroup:delete	√	×
Creating a transcoding template set	POST /v1.0/{project_id}/asset/template-collection/transcodings	vod:templateCollection:create	√	×
Updating a transcoding template set	PUT /v1.0/{project_id}/asset/template-collection/transcodings	vod:templateCollection:update	√	×
Querying transcoding template sets	GET /v1.0/{project_id}/asset/template-collection/transcodings	vod:templateCollection:list	√	×
Deleting a transcoding template set	DELETE /v1.0/{project_id}/asset/template-collection/transcodings	vod:templateCollection:delete	√	×
Deleting multiple transcoded outputs	DELETE /v1/{project_id}/asset/transcode-product	vod:asset:deleteTranscodeProduct	√	×
Updating the cold storage scope of a media asset	PUT /v1/{project_id}/asset/storage-mode-type	vod:storageModeType:update	√	×
Updating the media asset storage mode	PUT /v1/{project_id}/asset/storage-mode	vod:asset:updateStorageMode	√	×
Querying the cold storage scope of a media asset	GET /v1/{project_id}/asset/storage-mode-type	vod:storageModeType:get	√	×
Checking whether a media file has been stored in VOD	GET /v1.0/{project_id}/asset/duplication	vod:asset:checkDuplication	√	×
Querying the referer validation configuration of a domain name	-	vod:domain:getRefererGuard	√	×
Querying encryption configurations	-	vod:encryptionConfigurations:get	√	×
Querying information about a blocked media file	-	vod:asset:getShieldInfo	√	×
Querying a packaging template	-	vod:packagingGroup:list	√	×
Viewing a workflow template	-	vod:workflow:get	√	×
Querying a packaging template	-	vod:packagingConfigurations:get	√	×
Querying a URL pull task	-	vod:asset:getUploadTaskByUrl	√	×
Querying event notifications	-	vod:notification:get	√	×
Querying the URL validation configuration of a domain name	-	vod:domain:getUrlAuthGuard	√	×
Querying the IPv6 configuration of a domain name	-	vod:domain:getIpv6Config	√	×
Querying the CDN billing mode	-	vod:cdnBill:get	√	×
Querying role details	-	vod:role:get	√	×
Querying the HTTPS acceleration configuration of a domain name	-	vod:domain:getHttpsSetting	√	×
Querying workflow task details	-	vod:workflowTask:getDetails	√	×
Enabling the VOD service	-	vod:tenantInfo:update	√	×
Blocking a media file	-	vod:asset:shield	√	×
Creating a packaging template	-	vod:packagingConfigurations:create	√	×
Modifying the referer validation configuration of a domain name	-	vod:domain:modifyRefererGuard	√	×
Modifying the URL validation configuration of a domain name	-	vod:domain:modifyUrlAuthGuard	√	×
Enabling a domain name	-	vod:domain:enable	√	×
Modifying a role	-	vod:role:update	√	×
Deleting a workflow template	-	vod:workflow:delete	√	×
Resuming a URL pull task	-	vod:asset:retrievalUploadTaskByUrl	√	×
Deleting a permission template	-	vod:permissionTemplate:delete	√	×
Associating a packaging template	-	vod:asset:createPackagingRelation	√	×
Modifying a review template	-	vod:reviewTemplate:update	√	×
Updating the IPv6 configuration of a domain name	-	vod:domain:updateIpv6Config	√	×
Deleting a DRM template	-	vod:drm-template:delete	√	×
Updating encryption configurations	-	vod:encryptionConfigurations:update	√	×
Creating a review template	-	vod:reviewTemplate:create	√	×
Configuring event notifications	-	vod:notification:update	√	×
Deleting a packaging template	-	vod:packagingConfigurations:delete	√	×
Updating the permission template associated with a role	-	vod:role:updatePermissionTemplate	√	×
Creating a workflow template	-	vod:workflow:create	√	×
Modifying a domain name	-	vod:domain:update	√	×
Deleting a media asset cold storage policy	-	vod:storagePolicy:delete	√	×
Updating roles associated with a user	-	vod:user:updateRole	√	×
Updating a packaging template	-	vod:packagingGroup:update	√	×
Adding a domain name	-	vod:domain:create	√	×
Deleting a review template	-	vod:reviewTemplate:delete	√	×
Updating users associated with a role	-	vod:role:updateUser	√	×
Deleting a domain name	-	vod:domain:delete	√	×
Creating a media asset cold storage policy	-	vod:storagePolicy:create	√	×
Modifying a workflow template	-	vod:workflow:update	√	×
Canceling a URL pull task	-	vod:asset:stopUploadTaskByUrl	√	×
Deleting a role	-	vod:role:delete	√	×
Creating a role	-	vod:role:create	√	×
Modifying a permission template	-	vod:permissionTemplate:update	√	×
Creating a DRM template	-	vod:drm-template:create	√	×
Creating a permission template	-	vod:permissionTemplate:create	√	×
Disabling a domain name	-	vod:domain:disable	√	×
Creating a workflow task	-	vod:workflowTask:create	√	×
Updating the CDN billing mode	-	vod:cdnBill:update	√	×
Creating a packaging template	-	vod:packagingGroup:create	√	×
Deleting a packaging template	-	vod:packagingGroup:delete	√	×
Modifying the HTTPS acceleration configuration of a domain name	-	vod:domain:modifyHttpsSetting	√	×
Deleting a URL pull task	-	vod:asset:deleteUploadTaskByUrl	√	×
Modifying a media asset cold storage policy	-	vod:storagePolicy:update	√	×
Querying workflow templates	-	vod:workflow:list	√	×
Obtaining a signed URL	-	vod:asset:listAuthUrl	√	×
Querying packaging templates	-	vod:packagingConfigurations:list	√	×
Querying roles	-	vod:role:list	√	×
Querying DRM templates	-	vod:drm-template:list	√	×
Querying review templates	-	vod:reviewTemplate:list	√	×
Querying workflow tasks	-	vod:workflowTask:list	√	×
Querying objects	-	vod:object:list	√	×
Querying buckets	-	vod:bucket:list	√	×
Querying domain names	-	vod:domain:list	√	×
Querying permission templates	-	vod:permissionTemplate:list	√	×
Querying a media asset cold storage policy	-	vod:storagePolicy:list	√	×
Querying users	-	vod:user:list	√	×
Querying media asset tasks on the task management page	GET /v1/{project_id}/asset/tasks	vod:asset:getTaskInfo	√	×