[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[],[],null,["# Access control with IAM\n\nOverview\n--------\n\nLive Stream API uses [Identity and Access Management (IAM)](/iam) for\naccess control.\n\nYou can configure access control for the Live Stream API at the project\nlevel. For example, you can grant access for developers to list and get all\nevents within a project.\n\nFor a detailed description of IAM and its features, see the\n[IAM documentation](/iam/docs). In particular, see the section\non\n[managing IAM policies](/iam/docs/granting-changing-revoking-access).\n\nEvery Live Stream API method requires the caller to have the necessary\npermissions. For more information, see [Permissions](#permissions) and\n[Roles](#roles).\n\nPermissions\n-----------\n\nThis section summarizes the Live Stream API permissions that IAM supports.\n\n### Required permissions\n\nThe following tables list the IAM permissions that are associated with Live Stream API.\n| **Note:** Method names are shortened in the table; each method's full name begins with `projects.locations`.\n\nRoles\n-----\n\nThe following table lists the Live Stream API IAM\nroles, including the permissions associated with each role:\n\nFor more information about roles, see\n[Understanding roles](/iam/docs/understanding-roles).\n\nAccess to Cloud Storage\n-----------------------\n\nBy default, the Live Stream API has access to all of your project's\nCloud Storage buckets. When you create your first live streaming event, the\nLive Stream API creates a service account using the following naming\nconvention:\n\n`service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-livestream.iam.gserviceaccount.com`\n\n\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is the number of your project with the Live Stream API enabled. This service account is granted the Live Stream\nService Agent role and has permissions to do the following:\n\n- Read files in your project's Cloud Storage buckets\n- Upload files to your project's Cloud Storage buckets\n- Delete files in your project's Cloud Storage buckets\n- List files and their metadata in your project's Cloud Storage buckets\n\n| **Note:** It can take up to 7 minutes for the service account permissions to fully propagate across the system, see [Access change propagation](/iam/docs/access-change-propagation).\n\n### Limiting access\n\nTo limit this access to your Cloud Storage buckets, remove the Live Stream\nService Agent role from the service account and replace it with more\nfine-grained access. Follow these steps:\n\n1. Go to the [IAM](https://console.cloud.google.com/iam-admin/iam) page (**Permissions** tab) in the Google Cloud console.\n2. Find the service account with the Live Stream Service Agent role and select the edit button.\n3. Delete the Live Stream Service Agent role from the service account.\n4. Grant access to the service account for each individual Cloud Storage bucket:\n 1. Go to the [Cloud Storage Browser](https://console.cloud.google.com/storage/browser) page.\n 2. Click a bucket.\n 3. Select the **Permissions** tab.\n 4. Click **Add**.\n 5. In the **New principals** field, type the name of the service account.\n 6. Under **Role** , select **Storage Object Admin**.\n 7. Click **Save**. The Live Stream API now has access to the bucket."]]
