Actions, resources, and condition keys for AWS Elemental MediaLive

AWS Elemental MediaLive (service prefix: medialive) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by AWS Elemental MediaLive
Resource types defined by AWS Elemental MediaLive
Condition keys for AWS Elemental MediaLive

Actions defined by AWS Elemental MediaLive

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys
AcceptInputDeviceTransfer	Grants permission to accept an input device transfer	Write	input-device*
BatchDelete	Grants permission to delete channels, inputs, input security groups, and multiplexes	Write
BatchStart	Grants permission to start channels and multiplexes	Write
BatchStop	Grants permission to stop channels and multiplexes	Write
BatchUpdateSchedule	Grants permission to add and remove actions from a channel's schedule	Write	channel*
CancelInputDeviceTransfer	Grants permission to cancel an input device transfer	Write	input-device*
ClaimDevice	Grants permission to claim an input device	Write	input-device*
CreateChannel	Grants permission to create a channel	Write	channel*
			input*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateChannelPlacementGroup	Grants permission to create a cluster	Write	channel-placement-group*
			cluster*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateCloudWatchAlarmTemplate	Grants permission to create a cloudwatch alarm template	Write	cloudwatch-alarm-template*
			cloudwatch-alarm-template-group*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateCloudWatchAlarmTemplateGroup	Grants permission to create a cloudwatch alarm template group	Write	cloudwatch-alarm-template-group*
CreateCloudWatchAlarmTemplateGroup		Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateCluster	Grants permission to create a cluster	Write	cluster*
CreateCluster	Grants permission to create a cluster	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateEventBridgeRuleTemplate	Grants permission to create a eventbridge rule template	Write	eventbridge-rule-template*
			eventbridge-rule-template-group*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateEventBridgeRuleTemplateGroup	Grants permission to create a eventbridge rule template group	Write	eventbridge-rule-template-group*
CreateEventBridgeRuleTemplateGroup		Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateInput	Grants permission to create an input	Write	input*
			input-security-group*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateInputSecurityGroup	Grants permission to create an input security group	Write	input-security-group*
CreateInputSecurityGroup	Grants permission to create an input security group	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateMultiplex	Grants permission to create a multiplex	Write	multiplex*
CreateMultiplex	Grants permission to create a multiplex	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateMultiplexProgram	Grants permission to create a multiplex program	Write	multiplex*
CreateNetwork	Grants permission to create a network	Write	network*
CreateNetwork	Grants permission to create a network	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateNode	Grants permission to create a node	Write	cluster*
			node*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateNodeRegistrationScript	Grants permission to create a node registration script	Write	cluster*
CreatePartnerInput	Grants permission to create a partner input	Write	input*
CreatePartnerInput	Grants permission to create a partner input	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateSignalMap	Grants permission to create a signal map	Write	signal-map*
CreateSignalMap	Grants permission to create a signal map	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateTags	Grants permission to create tags for channels, inputs, input security groups, multiplexes, reservations, nodes, networks, clusters, channel placement groups, signal maps, template groups, and templates	Tagging	channel
			channel-placement-group
			cloudwatch-alarm-template
			cloudwatch-alarm-template-group
			cluster
			eventbridge-rule-template
			eventbridge-rule-template-group
			input
			input-security-group
			multiplex
			network
			node
			reservation
			signal-map
				aws:TagKeys aws:RequestTag/${TagKey}
DeleteChannel	Grants permission to delete a channel	Write	channel*
DeleteChannelPlacementGroup	Grants permission to delete a cluster	Write	channel-placement-group*
DeleteCloudWatchAlarmTemplate	Grants permission to delete a cloudwatch alarm template	Write	cloudwatch-alarm-template*
DeleteCloudWatchAlarmTemplateGroup	Grants permission to delete a cloudwatch alarm template group	Write	cloudwatch-alarm-template-group*
DeleteCluster	Grants permission to delete a cluster	Write	cluster*
DeleteEventBridgeRuleTemplate	Grants permission to delete a eventbridge rule template	Write	eventbridge-rule-template*
DeleteEventBridgeRuleTemplateGroup	Grants permission to delete a eventbridge rule template group	Write	eventbridge-rule-template-group*
DeleteInput	Grants permission to delete an input	Write	input*
DeleteInputSecurityGroup	Grants permission to delete an input security group	Write	input-security-group*
DeleteMultiplex	Grants permission to delete a multiplex	Write	multiplex*
DeleteMultiplexProgram	Grants permission to delete a multiplex program	Write	multiplex*
DeleteNetwork	Grants permission to delete a network	Write	network*
DeleteNode	Grants permission to delete a node	Write	node*
DeleteReservation	Grants permission to delete an expired reservation	Write	reservation*
DeleteSchedule	Grants permission to delete all schedule actions for a channel	Write	channel*
DeleteSignalMap	Grants permission to delete a signal map	Write	signal-map*
DeleteTags	Grants permission to delete tags from channels, inputs, input security groups, multiplexes, reservations, nodes, clusters, networks, channel placement groups, signal maps, template groups, and templates	Tagging	channel
			channel-placement-group
			cloudwatch-alarm-template
			cloudwatch-alarm-template-group
			cluster
			eventbridge-rule-template
			eventbridge-rule-template-group
			input
			input-security-group
			multiplex
			network
			node
			reservation
			signal-map
				aws:TagKeys
DescribeAccountConfiguration	Grants permission to view the account configuration of the customer	Read
DescribeChannel	Grants permission to get details about a channel	Read	channel*
DescribeChannelPlacementGroup	Grants permission to describe a channel placement group	Read	channel-placement-group*
DescribeCluster	Grants permission to describe a cluster	Read	cluster*
DescribeInput	Grants permission to describe an input	Read	input*
DescribeInputDevice	Grants permission to describe an input device	Read	input-device*
DescribeInputDeviceThumbnail	Grants permission to describe an input device thumbnail	Read	input-device*
DescribeInputSecurityGroup	Grants permission to describe an input security group	Read	input-security-group*
DescribeMultiplex	Grants permission to describe a multiplex	Read	multiplex*
DescribeMultiplexProgram	Grants permission to describe a multiplex program	Read	multiplex*
DescribeNetwork	Grants permission to describe a network	Read	network*
DescribeNode	Grants permission to describe a node	Read	node*
DescribeOffering	Grants permission to get details about a reservation offering	Read	offering*
DescribeReservation	Grants permission to get details about a reservation	Read	reservation*
DescribeSchedule	Grants permission to view a list of actions scheduled on a channel	Read	channel*
DescribeThumbnails	Grants permission to view the thumbnails for a channel	Read	channel*
GetCloudWatchAlarmTemplate	Grants permission to get a cloudwatch alarm template	Read	cloudwatch-alarm-template*
GetCloudWatchAlarmTemplateGroup	Grants permission to get a cloudwatch alarm template group	Read	cloudwatch-alarm-template-group*
GetEventBridgeRuleTemplate	Grants permission to get a eventbridge rule template	Read	eventbridge-rule-template*
GetEventBridgeRuleTemplateGroup	Grants permission to get a eventbridge rule template group	Read	eventbridge-rule-template-group*
GetSignalMap	Grants permission to get a signal map	Read	signal-map*
ListChannelPlacementGroups	Grants permission to list channel placement groups	List
ListChannels	Grants permission to list channels	List
ListCloudWatchAlarmTemplateGroups	Grants permission to list cloudwatch alarm template groups	List
ListCloudWatchAlarmTemplates	Grants permission to list cloudwatch alarm templates	List
ListClusters	Grants permission to list clusters	List
ListEventBridgeRuleTemplateGroups	Grants permission to list eventbridge rule template groups	List
ListEventBridgeRuleTemplates	Grants permission to list eventbridge rule templates	List
ListInputDeviceTransfers	Grants permission to list input device transfers	List
ListInputDevices	Grants permission to list input devices	List
ListInputSecurityGroups	Grants permission to list input security groups	List
ListInputs	Grants permission to list inputs	List
ListMultiplexPrograms	Grants permission to list multiplex programs	List
ListMultiplexes	Grants permission to list multiplexes	List
ListNetworks	Grants permission to list networks	List
ListNodes	Grants permission to list nodes	List
ListOfferings	Grants permission to list reservation offerings	List
ListReservations	Grants permission to list reservations	List
ListSignalMaps	Grants permission to list signal maps	List
ListTagsForResource	Grants permission to list tags for channels, inputs, input security groups, multiplexes, reservations, nodes, clusters, networks, channel placement groups, signal maps, template groups, and templates	List	channel
			channel-placement-group
			cloudwatch-alarm-template
			cloudwatch-alarm-template-group
			cluster
			eventbridge-rule-template
			eventbridge-rule-template-group
			input
			input-security-group
			multiplex
			network
			node
			reservation
			signal-map
PollAnywhere	Grants permission to the node to poll the cluster	Write
PurchaseOffering	Grants permission to purchase a reservation offering	Write	offering*
			reservation*
				aws:RequestTag/${TagKey} aws:TagKeys
RebootInputDevice	Grants permission to reboot an input device	Write	input-device*
RejectInputDeviceTransfer	Grants permission to reject an input device transfer	Write	input-device*
RestartChannelPipelines	Grants permission to restart pipelines on a running channel	Write	channel*
StartChannel	Grants permission to start a channel	Write	channel*
StartDeleteMonitorDeployment	Grants permission to start deletion of a signal map's monitor	Write	signal-map*
StartInputDevice	Grants permission to start an input device attached to a MediaConnect flow	Write	input-device*
StartInputDeviceMaintenanceWindow	Grants permission to start a maintenance window for an input device	Write	input-device*
StartMonitorDeployment	Grants permission to start a signal map monitor deployment	Write	signal-map*
StartMultiplex	Grants permission to start a multiplex	Write	multiplex*
StartUpdateSignalMap	Grants permission to start a signal map update	Write	signal-map*
StopChannel	Grants permission to stop a channel	Write	channel*
StopInputDevice	Grants permission to stop an input device attached to a MediaConnect flow	Write	input-device*
StopMultiplex	Grants permission to stop a multiplex	Write	multiplex*
SubmitAnywhereStateChange	Grants permission to the node to submit state changes to the cluster	Write
TransferInputDevice	Grants permission to transfer an input device	Write	input-device*
UpdateAccountConfiguration	Grants permission to update a customer's account configuration	Write
UpdateChannel	Grants permission to update a channel	Write	channel*
UpdateChannelClass	Grants permission to update the class of a channel	Write	channel*
UpdateChannelPlacementGroup	Grants permission to update a node	Write	channel-placement-group*
UpdateChannelPlacementGroup	Grants permission to update a node	Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateCloudWatchAlarmTemplate	Grants permission to update a cloudwatch alarm template	Write	cloudwatch-alarm-template*
UpdateCloudWatchAlarmTemplate	Grants permission to update a cloudwatch alarm template	Write	cloudwatch-alarm-template-group*
UpdateCloudWatchAlarmTemplateGroup	Grants permission to update a cloudwatch alarm template group	Write	cloudwatch-alarm-template-group*
UpdateCluster	Grants permission to update a cluster	Write	cluster*
UpdateCluster	Grants permission to update a cluster	Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateEventBridgeRuleTemplate	Grants permission to update a eventbridge rule template	Write	eventbridge-rule-template*
UpdateEventBridgeRuleTemplate	Grants permission to update a eventbridge rule template	Write	eventbridge-rule-template-group*
UpdateEventBridgeRuleTemplateGroup	Grants permission to update a eventbridge rule template group	Write	eventbridge-rule-template-group*
UpdateInput	Grants permission to update an input	Write	input*
UpdateInputDevice	Grants permission to update an input device	Write	input-device*
UpdateInputSecurityGroup	Grants permission to update an input security group	Write	input-security-group*
UpdateInputSecurityGroup	Grants permission to update an input security group	Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateMultiplex	Grants permission to update a multiplex	Write	multiplex*
UpdateMultiplexProgram	Grants permission to update a multiplex program	Write	multiplex*
UpdateNetwork	Grants permission to update the state of a node	Write	network*
UpdateNetwork	Grants permission to update the state of a node	Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateNode	Grants permission to update a node	Write	node*
UpdateNode	Grants permission to update a node	Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateNodeState	Grants permission to update the state of a node	Write	node*
UpdateNodeState	Grants permission to update the state of a node	Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateReservation	Grants permission to update a reservation	Write	reservation*

Resource types defined by AWS Elemental MediaLive

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
channel	`arn:${Partition}:medialive:${Region}:${Account}:channel:${ChannelId}`	aws:ResourceTag/${TagKey}
input	`arn:${Partition}:medialive:${Region}:${Account}:input:${InputId}`	aws:ResourceTag/${TagKey}
input-device	`arn:${Partition}:medialive:${Region}:${Account}:inputDevice:${DeviceId}`
input-security-group	`arn:${Partition}:medialive:${Region}:${Account}:inputSecurityGroup:${InputSecurityGroupId}`	aws:ResourceTag/${TagKey}
multiplex	`arn:${Partition}:medialive:${Region}:${Account}:multiplex:${MultiplexId}`	aws:ResourceTag/${TagKey}
reservation	`arn:${Partition}:medialive:${Region}:${Account}:reservation:${ReservationId}`	aws:ResourceTag/${TagKey}
offering	`arn:${Partition}:medialive:${Region}:${Account}:offering:${OfferingId}`
signal-map	`arn:${Partition}:medialive:${Region}:${Account}:signal-map:${SignalMapId}`	aws:ResourceTag/${TagKey}
cloudwatch-alarm-template-group	`arn:${Partition}:medialive:${Region}:${Account}:cloudwatch-alarm-template-group:${CloudWatchAlarmTemplateGroupId}`	aws:ResourceTag/${TagKey}
cloudwatch-alarm-template	`arn:${Partition}:medialive:${Region}:${Account}:cloudwatch-alarm-template:${CloudWatchAlarmTemplateId}`	aws:ResourceTag/${TagKey}
eventbridge-rule-template-group	`arn:${Partition}:medialive:${Region}:${Account}:eventbridge-rule-template-group:${EventBridgeRuleTemplateGroupId}`	aws:ResourceTag/${TagKey}
eventbridge-rule-template	`arn:${Partition}:medialive:${Region}:${Account}:eventbridge-rule-template:${EventBridgeRuleTemplateId}`	aws:ResourceTag/${TagKey}
cluster	`arn:${Partition}:medialive:${Region}:${Account}:cluster:${ClusterId}`	aws:ResourceTag/${TagKey}
node	`arn:${Partition}:medialive:${Region}:${Account}:node:${ClusterId}/${NodeId}`	aws:ResourceTag/${TagKey}
network	`arn:${Partition}:medialive:${Region}:${Account}:network:${NetworkId}`	aws:ResourceTag/${TagKey}
channel-placement-group	`arn:${Partition}:medialive:${Region}:${Account}:channelPlacementGroup:${ClusterId}/${ChannelPlacementGroupId}`	aws:ResourceTag/${TagKey}

Condition keys for AWS Elemental MediaLive

AWS Elemental MediaLive defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Elemental MediaConvert

AWS Elemental MediaPackage