Heat Sample Policy

Warning

JSON formatted policy file is deprecated since Heat 17.0.0 (Xena). This oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.

The following is a sample heat policy file that has been auto-generated from default policy values in code. If you’re using the default policies, then the maintenance of this file is not necessary, and it should not be copied into a deployment. Doing so will result in duplicate policy definitions. It is here to help explain which policy operations protect specific heat APIs, but it is not suggested to copy and paste into a deployment unless you’re planning on providing a different policy for an operation that is not the default.

If you wish build a policy file, you can also use tox -e genpolicy to generate it.

The sample policy file can also be downloaded in file form.

"context_is_admin": "(role:admin and is_admin_project:True) OR (role:admin and system_scope:all)"
"project_admin": "role:admin"
"deny_stack_user": "not role:heat_stack_user"
"deny_everybody": "!"
"allow_everybody": ""
"actions:action": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "actions:action":"rule:deny_stack_user" has been deprecated since W
# in favor of "actions:action":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The actions API now supports system scope and default roles.

"actions:snapshot": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "actions:snapshot":"rule:deny_stack_user" has been deprecated since
# W in favor of "actions:snapshot":"(role:admin and system_scope:all)
# or (role:member and project_id:%(project_id)s)".
# The actions API now supports system scope and default roles.

"actions:suspend": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "actions:suspend":"rule:deny_stack_user" has been deprecated since W
# in favor of "actions:suspend":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The actions API now supports system scope and default roles.

"actions:resume": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "actions:resume":"rule:deny_stack_user" has been deprecated since W
# in favor of "actions:resume":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The actions API now supports system scope and default roles.

"actions:check": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "actions:check":"rule:deny_stack_user" has been deprecated since W
# in favor of "actions:check":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The actions API now supports system scope and default roles.

"actions:cancel_update": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "actions:cancel_update":"rule:deny_stack_user" has been deprecated
# since W in favor of "actions:cancel_update":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The actions API now supports system scope and default roles.

"actions:cancel_without_rollback": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "actions:cancel_without_rollback":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "actions:cancel_without_rollback":"(role:admin and system_scope:all)
# or (role:member and project_id:%(project_id)s)".
# The actions API now supports system scope and default roles.

"build_info:build_info": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "build_info:build_info":"rule:deny_stack_user" has been deprecated
# since W in favor of "build_info:build_info":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The build API now supports system scope and default roles.

"cloudformation:ListStacks": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:ListStacks":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "cloudformation:ListStacks":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:CreateStack": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:CreateStack":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "cloudformation:CreateStack":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:DescribeStacks": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:DescribeStacks":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "cloudformation:DescribeStacks":"(role:reader and system_scope:all)
# or (role:reader and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:DeleteStack": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:DeleteStack":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "cloudformation:DeleteStack":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:UpdateStack": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:UpdateStack":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "cloudformation:UpdateStack":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:CancelUpdateStack": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:CancelUpdateStack":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "cloudformation:CancelUpdateStack":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:DescribeStackEvents": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:DescribeStackEvents":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "cloudformation:DescribeStackEvents":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:ValidateTemplate": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:ValidateTemplate":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "cloudformation:ValidateTemplate":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:GetTemplate": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:GetTemplate":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "cloudformation:GetTemplate":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:EstimateTemplateCost": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:EstimateTemplateCost":"rule:deny_stack_user" has
# been deprecated since W in favor of
# "cloudformation:EstimateTemplateCost":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:DescribeStackResource": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or (role:heat_stack_user and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:DescribeStackResource":"rule:allow_everybody" has
# been deprecated since W in favor of
# "cloudformation:DescribeStackResource":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s) or
# (role:heat_stack_user and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:DescribeStackResources": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:DescribeStackResources":"rule:deny_stack_user" has
# been deprecated since W in favor of
# "cloudformation:DescribeStackResources":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"cloudformation:ListStackResources": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "cloudformation:ListStackResources":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "cloudformation:ListStackResources":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The cloud formation API now supports system scope and default roles.

"events:index": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "events:index":"rule:deny_stack_user" has been deprecated since W in
# favor of "events:index":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The events API now supports system scope and default roles.

"events:show": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "events:show":"rule:deny_stack_user" has been deprecated since W in
# favor of "events:show":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The events API now supports system scope and default roles.

"resource:index": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "resource:index":"rule:deny_stack_user" has been deprecated since W
# in favor of "resource:index":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The resources API now supports system scope and default roles.

"resource:metadata": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or (role:heat_stack_user and project_id:%(project_id)s)"
# DEPRECATED
# "resource:metadata":"rule:allow_everybody" has been deprecated since
# W in favor of "resource:metadata":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s) or
# (role:heat_stack_user and project_id:%(project_id)s)".
# The resources API now supports system scope and default roles.

"resource:signal": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or (role:heat_stack_user and project_id:%(project_id)s)"
# DEPRECATED
# "resource:signal":"rule:allow_everybody" has been deprecated since W
# in favor of "resource:signal":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s) or (role:heat_stack_user
# and project_id:%(project_id)s)".
# The resources API now supports system scope and default roles.

"resource:mark_unhealthy": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "resource:mark_unhealthy":"rule:deny_stack_user" has been deprecated
# since W in favor of "resource:mark_unhealthy":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The resources API now supports system scope and default roles.

"resource:show": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "resource:show":"rule:deny_stack_user" has been deprecated since W
# in favor of "resource:show":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The resources API now supports system scope and default roles.

"resource_types:OS::Nova::Flavor": "rule:project_admin"
"resource_types:OS::Cinder::EncryptedVolumeType": "rule:project_admin"
"resource_types:OS::Cinder::VolumeType": "rule:project_admin"
"resource_types:OS::Cinder::Quota": "rule:project_admin"
"resource_types:OS::Neutron::Quota": "rule:project_admin"
"resource_types:OS::Nova::Quota": "rule:project_admin"
"resource_types:OS::Octavia::Quota": "rule:project_admin"
"resource_types:OS::Manila::ShareType": "rule:project_admin"
"resource_types:OS::Neutron::ProviderNet": "rule:project_admin"
"resource_types:OS::Neutron::QoSPolicy": "rule:project_admin"
"resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:project_admin"
"resource_types:OS::Neutron::QoSDscpMarkingRule": "rule:project_admin"
"resource_types:OS::Neutron::QoSMinimumBandwidthRule": "rule:project_admin"
"resource_types:OS::Neutron::Segment": "rule:project_admin"
"resource_types:OS::Nova::HostAggregate": "rule:project_admin"
"resource_types:OS::Cinder::QoSSpecs": "rule:project_admin"
"resource_types:OS::Cinder::QoSAssociation": "rule:project_admin"
"resource_types:OS::Keystone::*": "rule:project_admin"
"resource_types:OS::Blazar::Host": "rule:project_admin"
"resource_types:OS::Octavia::Flavor": "rule:project_admin"
"resource_types:OS::Octavia::FlavorProfile": "rule:project_admin"
"service:index": "role:reader and system_scope:all"
# DEPRECATED
# "service:index":"rule:context_is_admin" has been deprecated since W
# in favor of "service:index":"role:reader and system_scope:all".
# The service API now supports system scope and default roles.

"software_configs:global_index": "role:reader and system_scope:all"
# DEPRECATED
# "software_configs:global_index":"rule:deny_everybody" has been
# deprecated since W in favor of
# "software_configs:global_index":"role:reader and system_scope:all".
# The software configuration API now support system scope and default
# roles.

"software_configs:index": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "software_configs:index":"rule:deny_stack_user" has been deprecated
# since W in favor of "software_configs:index":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The software configuration API now support system scope and default
# roles.

"software_configs:create": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "software_configs:create":"rule:deny_stack_user" has been deprecated
# since W in favor of "software_configs:create":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The software configuration API now support system scope and default
# roles.

"software_configs:show": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "software_configs:show":"rule:deny_stack_user" has been deprecated
# since W in favor of "software_configs:show":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The software configuration API now support system scope and default
# roles.

"software_configs:delete": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "software_configs:delete":"rule:deny_stack_user" has been deprecated
# since W in favor of "software_configs:delete":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The software configuration API now support system scope and default
# roles.

"software_deployments:index": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "software_deployments:index":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "software_deployments:index":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The software deployment API now supports system scope and default
# roles.

"software_deployments:create": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "software_deployments:create":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "software_deployments:create":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The software deployment API now supports system scope and default
# roles.

"software_deployments:show": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "software_deployments:show":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "software_deployments:show":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The software deployment API now supports system scope and default
# roles.

"software_deployments:update": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "software_deployments:update":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "software_deployments:update":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The software deployment API now supports system scope and default
# roles.

"software_deployments:delete": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "software_deployments:delete":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "software_deployments:delete":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The software deployment API now supports system scope and default
# roles.

"software_deployments:metadata": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or (role:heat_stack_user and project_id:%(project_id)s)"
"stacks:abandon": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:abandon":"rule:deny_stack_user" has been deprecated since W
# in favor of "stacks:abandon":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:create": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:create":"rule:deny_stack_user" has been deprecated since W
# in favor of "stacks:create":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:delete": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:delete":"rule:deny_stack_user" has been deprecated since W
# in favor of "stacks:delete":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:detail": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:detail":"rule:deny_stack_user" has been deprecated since W
# in favor of "stacks:detail":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:export": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:export":"rule:deny_stack_user" has been deprecated since W
# in favor of "stacks:export":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:generate_template": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:generate_template":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "stacks:generate_template":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:global_index": "role:reader and system_scope:all"
# DEPRECATED
# "stacks:global_index":"rule:deny_everybody" has been deprecated
# since W in favor of "stacks:global_index":"role:reader and
# system_scope:all".
# The stack API now supports system scope and default roles.

"stacks:index": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:index":"rule:deny_stack_user" has been deprecated since W in
# favor of "stacks:index":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:list_resource_types": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:list_resource_types":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "stacks:list_resource_types":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:list_template_versions": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:list_template_versions":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "stacks:list_template_versions":"(role:reader and system_scope:all)
# or (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:list_template_functions": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:list_template_functions":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "stacks:list_template_functions":"(role:reader and system_scope:all)
# or (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:lookup": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or (role:heat_stack_user and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:lookup":"rule:allow_everybody" has been deprecated since W
# in favor of "stacks:lookup":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s) or (role:heat_stack_user
# and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:preview": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:preview":"rule:deny_stack_user" has been deprecated since W
# in favor of "stacks:preview":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:resource_schema": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:resource_schema":"rule:deny_stack_user" has been deprecated
# since W in favor of "stacks:resource_schema":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:show": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:show":"rule:deny_stack_user" has been deprecated since W in
# favor of "stacks:show":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:template": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:template":"rule:deny_stack_user" has been deprecated since W
# in favor of "stacks:template":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:environment": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:environment":"rule:deny_stack_user" has been deprecated
# since W in favor of "stacks:environment":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:files": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:files":"rule:deny_stack_user" has been deprecated since W in
# favor of "stacks:files":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:update": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:update":"rule:deny_stack_user" has been deprecated since W
# in favor of "stacks:update":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:update_patch": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:update_patch":"rule:deny_stack_user" has been deprecated
# since W in favor of "stacks:update_patch":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:update_no_change": "rule:stacks:update_patch"
"stacks:preview_update": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:preview_update":"rule:deny_stack_user" has been deprecated
# since W in favor of "stacks:preview_update":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:preview_update_patch": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:preview_update_patch":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "stacks:preview_update_patch":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:validate_template": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:validate_template":"rule:deny_stack_user" has been
# deprecated since W in favor of
# "stacks:validate_template":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:snapshot": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:snapshot":"rule:deny_stack_user" has been deprecated since W
# in favor of "stacks:snapshot":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:show_snapshot": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:show_snapshot":"rule:deny_stack_user" has been deprecated
# since W in favor of "stacks:show_snapshot":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:delete_snapshot": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:delete_snapshot":"rule:deny_stack_user" has been deprecated
# since W in favor of "stacks:delete_snapshot":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:list_snapshots": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:list_snapshots":"rule:deny_stack_user" has been deprecated
# since W in favor of "stacks:list_snapshots":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:restore_snapshot": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:restore_snapshot":"rule:deny_stack_user" has been deprecated
# since W in favor of "stacks:restore_snapshot":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:list_outputs": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:list_outputs":"rule:deny_stack_user" has been deprecated
# since W in favor of "stacks:list_outputs":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.

"stacks:show_output": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "stacks:show_output":"rule:deny_stack_user" has been deprecated
# since W in favor of "stacks:show_output":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The stack API now supports system scope and default roles.