Setting up users with IAM permissions - MediaLive
Required permissionsCreating the policy

Setting up users with IAM permissions

This section describes the permissions that an IAM administrator must assign to users and other AWS identities so that they can configure a Link device to work with a MediaLive input or an MediaConnect flow.

This information supplements the information about setting up a user to work with all MediaLive features. Read this information as follows:

  • Read this section if your organization has users who will only work with MediaLive to deploy devices and configure them for use as sources, and you want to follow a least permissions rule.

  • If your organization has users who will deploy devices, use those devices, and use all MediaLive features, see Requirements for AWS Elemental Link. You should revise their existing policies to include the device permissions.

This section assumes that you have already performed these tasks:

Required permissions

You must assign permissions for actions in several services, as described in the following table.

Permissions Service name in IAM Actions
View, configure, and manage a Link device medialive

DescribeInputDevice

DescribeInputDeviceThumbnail

ListInputDevices

RebootInputDevice

StartInputDeviceMaintenanceWindow

StartInputDevice

StopInputDevice

UpdateInputDevice
Handle transfers of Link devices medialive

AcceptInputDeviceTransfer

CancelInputDeviceTransfer

ClaimDevice

ListInputDeviceTransfers

RejectInputDeviceTransfer

TransferInputDevice

On the MediaLive console, view MediaConnect flows in the dropdown list. This dropdown list appears in the Flow ARN field in the Attachments tab on the Device details page.

 mediaconnect ListFlows

On the MediaLive console, view Secrets Manager secrets in the dropdown list. This dropdown list appears in the Secret ARN field in the Attachments tab on the Device details page.

 secretsmanager ListSecrets

On the MediaLive console, view IAM roles in the dropdown list. This dropdown list appears in the Role ARN field in the Attachments tab on the Device details page.

 iam ListRoles

Creating the policy

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane on the left, choose Policies. Choose Create Policy, then choose the JSON tab.

  3. In the Policy editor, clear the sample content and paste the policy that appears after this procedure.

  4. Give the policy a name that makes it clear that this policy is for using Link. For example, ElementalLinkAccess.

  5. Choose Create policy.

Sample policy:

 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "medialive:DescribeInputDevice",
        "medialive:DescribeInputDeviceThumbnail",
        "medialive:ListInputDevices",
        "medialive:RebootInputDevice",
        "medialive:StartInputDeviceMaintenanceWindow",
        "medialive:StartInputDevice",
        "medialive:StopInputDevice",
        "medialive:UpdateInputDevice"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "medialive:AcceptInputDeviceTransfer",
        "medialive:CancelInputDeviceTransfer",
        "medialive:ClaimDevice",
        "medialive:ListInputDeviceTransfers",
        "medialive:RejectInputDeviceTransfer",
        "medialive:TransferInputDevice"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "mediaconnect:ListFlows"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:ListSecrets"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:ListRoles"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}