policy.yaml

Warning

JSON formatted policy file is deprecated since Aodh 12.0.0 (Wallaby). This oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.

Use the policy.yaml file to define additional access controls that will be applied to Aodh:

"context_is_admin": "role:admin"
"segregation": "rule:context_is_admin"
"admin_or_owner": "rule:context_is_admin or project_id:%(project_id)s"
"default": "rule:context_is_admin or project_id:%(project_id)s"
"telemetry:get_alarm": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "telemetry:get_alarm":"rule:context_is_admin or
# project_id:%(project_id)s" has been deprecated since W in favor of
# "telemetry:get_alarm":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:get_alarms": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "telemetry:get_alarms":"rule:context_is_admin or
# project_id:%(project_id)s" has been deprecated since W in favor of
# "telemetry:get_alarms":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:get_alarms:all_projects": "role:reader and system_scope:all"
# DEPRECATED
# "telemetry:get_alarms:all_projects":"rule:context_is_admin" has been
# deprecated since W in favor of
# "telemetry:get_alarms:all_projects":"role:reader and
# system_scope:all".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:query_alarm": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "telemetry:query_alarm":"rule:context_is_admin or
# project_id:%(project_id)s" has been deprecated since W in favor of
# "telemetry:query_alarm":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:create_alarm": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "telemetry:create_alarm":"" has been deprecated since W in favor of
# "telemetry:create_alarm":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:change_alarm": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "telemetry:change_alarm":"rule:context_is_admin or
# project_id:%(project_id)s" has been deprecated since W in favor of
# "telemetry:change_alarm":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:delete_alarm": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "telemetry:delete_alarm":"rule:context_is_admin or
# project_id:%(project_id)s" has been deprecated since W in favor of
# "telemetry:delete_alarm":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:get_alarm_state": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "telemetry:get_alarm_state":"rule:context_is_admin or
# project_id:%(project_id)s" has been deprecated since W in favor of
# "telemetry:get_alarm_state":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:change_alarm_state": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "telemetry:change_alarm_state":"rule:context_is_admin or
# project_id:%(project_id)s" has been deprecated since W in favor of
# "telemetry:change_alarm_state":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:alarm_history": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "telemetry:alarm_history":"rule:context_is_admin or
# project_id:%(project_id)s" has been deprecated since W in favor of
# "telemetry:alarm_history":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:query_alarm_history": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "telemetry:query_alarm_history":"rule:context_is_admin or
# project_id:%(project_id)s" has been deprecated since W in favor of
# "telemetry:query_alarm_history":"(role:reader and system_scope:all)
# or (role:reader and project_id:%(project_id)s)".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:update_quotas": "role:admin and system_scope:all"
# DEPRECATED
# "telemetry:update_quotas":"rule:context_is_admin" has been
# deprecated since W in favor of "telemetry:update_quotas":"role:admin
# and system_scope:all".
# The alarm and quota APIs now support system-scope and default roles.

"telemetry:delete_quotas": "role:admin and system_scope:all"
# DEPRECATED
# "telemetry:delete_quotas":"rule:context_is_admin" has been
# deprecated since W in favor of "telemetry:delete_quotas":"role:admin
# and system_scope:all".
# The alarm and quota APIs now support system-scope and default roles.