Live (Live)
IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies using the actions supported by cloud services for more refined access control.
In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.
SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.
To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.
This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.
- For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
- For details about how to use these elements to edit a custom SCP, see Creating an SCP.
Actions
Actions are specific operations that are allowed or denied in an identity policy.
- The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
- The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by Live, see Resources.
- The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by Live, see Conditions.
- The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.
The following table lists the actions that you can define in identity policy statements for Live.
|
Action |
Description |
Access Level |
Resource Type (*: required) |
Condition Key |
Alias |
|---|---|---|---|---|---|
|
live:domain:createDomain |
Grants permission to create a domain name. |
Write |
- |
- |
- |
|
live:domain:getDomains |
Grants permission to query a domain name. |
Read |
- |
- |
- |
|
live:domain:deleteDomain |
Grants permission to delete a domain name. |
Write |
- |
- |
- |
|
live:domain:updateDomain |
Grants permission to modify a domain name. |
Write |
- |
- |
- |
|
live:domain:createDomainsMapping |
Grants permission to map domain names. |
Write |
- |
- |
- |
|
live:domain:deleteDomainsMapping |
Grants permission to delete the mapping between domain names. |
Write |
- |
- |
- |
|
live:domain:updateStreamNotification |
Grants permission to add or modify the configuration of stream status notifications. |
Write |
- |
- |
- |
|
live:domain:getStreamNotifications |
Grants permission to query the configuration of stream status notifications. |
Read |
- |
- |
- |
|
live:domain:deleteStreamNotification |
Grants permission to delete the configuration of stream status notifications. |
Write |
- |
- |
- |
|
live:domain:createCDNConfig |
Grants permission to create domain name configuration items. |
Write |
- |
- |
- |
|
live:domain:updateCDNConfig |
Grants permission to modify domain name configuration items. |
Write |
- |
- |
- |
|
live:domain:getCDNConfig |
Grants permission to query domain name configuration items. |
Read |
- |
- |
- |
|
live:domain:deleteCDNConfig |
Grants permission to delete domain name configuration items. |
Write |
- |
- |
- |
|
live:domain:getIPAuthList |
Grants permission to query the IP address blacklist or whitelist. |
Read |
- |
- |
- |
|
live:domain:updateIPAuthList |
Grants permission to modify the IP address blacklist or whitelist. |
Write |
- |
- |
- |
|
live:domain:getGeoBlockingList |
Grants permission to obtain regions with livestreaming restrictions. |
Read |
- |
- |
- |
|
live:domain:updateGeoBlocking |
Grants permission to modify regions with livestreaming restrictions. |
Write |
- |
- |
- |
|
live:domain:updateRefererChain |
Grants permission to set the referer validation blacklist and whitelist. |
Write |
- |
- |
- |
|
live:domain:deleteRefererChain |
Grants permission to delete the referer validation blacklist and whitelist. |
Write |
- |
- |
- |
|
live:domain:getRefererChain |
Grants permission to query the referer validation blacklist and whitelist. |
Read |
- |
- |
- |
|
live:logs:listLog |
Grants permission to obtain the link for downloading playback logs. |
Read |
- |
- |
- |
|
live:domain:getCertificates |
Grants permission to query HTTPS certificate information. |
Read |
- |
- |
- |
|
live:record:createRule |
Grants permission to create a recording rule. |
Write |
- |
- |
- |
|
live:record:listRules |
Grants permission to query recording rules. |
Read |
- |
- |
- |
|
live:record:updateRule |
Grants permission to modify a recording rule. |
Write |
- |
- |
- |
|
live:record:deleteRule |
Grants permission to delete a recording rule. |
Write |
- |
- |
- |
|
live:record:getRule |
Grants permission to query a recording rule. |
Read |
- |
- |
- |
|
live:record:listContents |
Grants permission to query recordings. |
Read |
- |
- |
- |
|
live:record:createCommand |
Grants permission to submit a command for controlling recording. |
Write |
- |
- |
- |
|
live:record:createCallback |
Grants permission to create a recording callback rule. |
Write |
- |
- |
- |
|
live:record:listCallbacks |
Grants permission to query recording callback rules. |
Read |
- |
- |
- |
|
live:record:updateCallback |
Grants permission to modify a recording callback rule. |
Write |
- |
- |
- |
|
live:record:getCallback |
Grants permission to query a recording callback rule. |
Read |
- |
- |
- |
|
live:record:deleteCallback |
Grants permission to delete a recording callback rule. |
Write |
- |
- |
- |
|
live:snapshot:createRule |
Grants permission to configure snapshot capture. |
Write |
- |
- |
- |
|
live:snapshot:updateRule |
Grants permission to modify snapshot capture. |
Write |
- |
- |
- |
|
live:snapshot:listRules |
Grants permission to query snapshot capture. |
Read |
- |
- |
- |
|
live:snapshot:deleteRule |
Grants permission to delete snapshot capture. |
Write |
- |
- |
- |
|
live:stream:createStreamForbidden |
Grants permission to disable a push stream. |
Write |
- |
- |
- |
|
live:stream:listStreamForbidden |
Grants permission to query disabled streams. |
Read |
- |
- |
- |
|
live:stream:deleteStreamForbidden |
Grants permission to resume a push stream. |
Write |
- |
- |
- |
|
live:stream:updateStreamForbidden |
Grants permission to modify the attribute of a disabled stream. |
Write |
- |
- |
- |
|
live:stream:createStreamForbiddenOnce |
Grants permission to disconnect a stream. |
Write |
- |
- |
- |
|
live:stream:listLiveStreamsOnline |
Grants permission to query online streams. |
Read |
- |
- |
- |
|
live:stream:createPullTask |
Grants permission to create a task for ingesting streams from external networks. |
Write |
- |
- |
- |
|
live:stream:deletePullTask |
Grants permission to delete a task for ingesting streams from external networks. |
Write |
- |
- |
- |
|
live:stream:listPullTask |
Grants permission to query a task for ingesting streams from external networks. |
Read |
- |
- |
- |
|
live:tenant:updateChargingMode |
Grants permission to configure the billing mode. |
Write |
- |
- |
- |
|
live:tenant:getTenantInformation |
Grants permission to query tenant information. |
Read |
- |
- |
- |
|
live:transcode:createTranscodingsTemplate |
Grants permission to create a transcoding template. |
Write |
- |
- |
- |
|
live:transcode:deleteTranscodingsTemplate |
Grants permission to delete a transcoding template. |
Write |
- |
- |
- |
|
live:transcode:updateTranscodingsTemplate |
Grants permission to modify a transcoding template. |
Write |
- |
- |
- |
|
live:transcode:listTranscodingsTemplate |
Grants permission to query a transcoding template. |
Read |
- |
- |
- |
|
live:transcode:createSEI |
Grants permission to add transcoding SEI. |
Write |
- |
- |
- |
Each API of Live usually supports one or more actions. Table 2 lists the supported actions and dependencies.
|
API |
Action |
Dependencies |
|---|---|---|
|
POST /v1/{project_id}/domain |
live:domain:createDomain |
- |
|
DELETE /v1/{project_id}/domain |
live:domain:deleteDomain |
- |
|
PUT /v1/{project_id}/domain |
live:domain:updateDomain |
- |
|
GET /v1/{project_id}/domain |
live:domain:getDomains |
- |
|
PUT /v1/{project_id}/domains_mapping |
live:domain:createDomainsMapping |
- |
|
DELETE /v1/{project_id}/domains_mapping |
live:domain:deleteDomainsMapping |
- |
|
PUT /v1/{project_id}/notifications/publish |
live:domain:updateStreamNotification |
- |
|
GET /v1/{project_id}/notifications/publish |
live:domain:getStreamNotifications |
- |
|
DELETE /v1/{project_id}/notifications/publish |
live:domain:deleteStreamNotification |
- |
|
POST /v1/{project_id}/domain/config |
live:domain:createCDNConfig |
- |
|
PUT /v1/{project_id}/domain/config |
live:domain:updateCDNConfig |
- |
|
GET /v1/{project_id}/domain/config |
live:domain:getCDNConfig |
- |
|
DELETE /v1/{project_id}/domain/config |
live:domain:deleteCDNConfig |
- |
|
GET /v1/{project_id}/guard/ip |
live:domain:getIPAuthList |
- |
|
PUT /v1/{project_id}/guard/ip |
live:domain:updateIPAuthList |
- |
|
GET /v1/{project_id}/guard/geo-blocking |
live:domain:getGeoBlockingList |
- |
|
PUT /v1/{project_id}/guard/geo-blocking |
live:domain:updateGeoBlocking |
- |
|
PUT /v1/{project_id}/guard/referer-chain |
live:domain:updateRefererChain |
- |
|
DELETE /v1/{project_id}/guard/referer-chain |
live:domain:deleteRefererChain |
- |
|
GET /v1/{project_id}/guard/referer-chain |
live:domain:getRefererChain |
- |
|
GET /v1/{project_id}/logs |
live:logs:listLog |
- |
|
GET /v2/{project_id}/certificates |
live:domain:getCertificates |
- |
|
POST /v1/{project_id}/record/rules |
live:record:createRule |
- |
|
GET /v1/{project_id}/record/rules |
live:record:listRules |
- |
|
PUT /v1/{project_id}/record/rules/{id} |
live:record:updateRule |
- |
|
DELETE /v1/{project_id}/record/rules/{id} |
live:record:deleteRule |
- |
|
GET /v1/{project_id}/record/rules/{id} |
live:record:getRule |
- |
|
GET /v1/{project_id}/record/contents |
live:record:listContents |
- |
|
POST /v1/{project_id}/record/control |
live:record:createCommand |
- |
|
POST /v1/{project_id}/record/callbacks |
live:record:createCallback |
- |
|
GET /v1/{project_id}/record/callbacks |
live:record:listCallbacks |
- |
|
PUT /v1/{project_id}/record/callbacks/{id} |
live:record:updateCallback |
- |
|
GET /v1/{project_id}/record/callbacks/{id} |
live:record:getCallback |
- |
|
DELETE /v1/{project_id}/record/callbacks/{id} |
live:record:deleteCallback |
- |
|
POST /v1/{project_id}/stream/snapshot |
live:snapshot:createRule |
- |
|
PUT /v1/{project_id}/stream/snapshot |
live:snapshot:updateRule |
- |
|
GET /v1/{project_id}/stream/snapshot |
live:snapshot:listRules |
- |
|
DELETE /v1/{project_id}/stream/snapshot |
live:snapshot:deleteRule |
- |
|
POST /v1/{project_id}/stream/blocks |
live:stream:createStreamForbidden |
- |
|
GET /v1/{project_id}/stream/blocks |
live:stream:listStreamForbidden |
- |
|
DELETE /v1/{project_id}/stream/blocks |
live:stream:deleteStreamForbidden |
- |
|
PUT /v1/{project_id}/stream/blocks |
live:stream:updateStreamForbidden |
- |
|
POST /v1/{project_id}/stream/block-once |
live:stream:createStreamForbiddenOnce |
- |
|
GET /v1/{project_id}/realtime/streams |
live:stream:listLiveStreamsOnline |
- |
|
POST /v1/{project_id}/pull/stream |
live:stream:createPullTask |
- |
|
DELETE /v1/{project_id}/pull/stream |
live:stream:deletePullTask |
- |
|
GET /v1/{project_id}/pull/stream_list |
live:stream:listPullTask |
- |
|
PUT /v1/{project_id}/tenant/charging_mode |
live:tenant:updateChargingMode |
- |
|
GET /v1/{project_id}/tenant/info |
live:tenant:getTenantInformation |
- |
|
POST /v1/{project_id}/template/transcodings |
live:transcode:createTranscodingsTemplate |
- |
|
DELETE /v1/{project_id}/template/transcodings |
live:transcode:deleteTranscodingsTemplate |
- |
|
PUT /v1/{project_id}/template/transcodings |
live:transcode:updateTranscodingsTemplate |
- |
|
GET /v1/{project_id}/template/transcodings |
live:transcode:listTranscodingsTemplate |
- |
|
PUT /v1/{project_id}/transcode/sei |
live:transcode:createSEI |
- |
|
GET /v1/{project_id}/guard/key-chain |
live:domain:getCDNConfig |
- |
|
PUT /v1/{project_id}/guard/key-chain |
live:domain:updateCDNConfig |
- |
|
DELETE /v1/{project_id}/guard/key-chain |
live:domain:deleteCDNConfig |
- |
|
PUT /v1/{project_id}/guard/https-cert |
live:domain:updateCDNConfig |
- |
|
GET /v1/{project_id}/guard/https-cert |
live:domain:getCDNConfig |
- |
|
DELETE /v1/{project_id}/guard/https-cert |
live:domain:deleteCDNConfig |
- |
|
POST /v1/{project_id}/pull/stream/task |
live:stream:createPullTask |
- |
|
DELETE /v1/{project_id}/pull/stream/task |
live:stream:deletePullTask |
- |
|
GET /v1/{project_id}/pull/stream/task |
live:stream:listPullTask |
- |
Resources
Live does not support resource-level authorization. To allow access to Live, use a wildcard (*) in the Resource element of the identity policy, indicating that the identity policy will be applied to all resources.
Conditions
Live does not support service-specific condition keys in identity policies.It can only use global condition keys applicable to all services. For details, see Global Condition Keys.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
