policy.yaml¶
Use the policy.yaml
file to define additional access controls that apply to
the DNS service:
"admin": "role:admin or is_admin:True"
"owner": "project_id:%(tenant_id)s"
"admin_or_owner": "rule:admin or rule:owner"
"default": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "default":"rule:admin_or_owner" has been deprecated since W in favor
# of "default":"(role:admin and system_scope:all) or (role:member and
# project_id:%(project_id)s)".
# The designate API now supports system scope and default roles.
"create_blacklist": "role:admin and system_scope:all"
# DEPRECATED
# "create_blacklist":"rule:admin" has been deprecated since W in favor
# of "create_blacklist":"role:admin and system_scope:all".
# The blacklist API now supports system scope and default roles.
"find_blacklists": "role:reader and system_scope:all"
# DEPRECATED
# "find_blacklists":"rule:admin" has been deprecated since W in favor
# of "find_blacklists":"role:reader and system_scope:all".
# The blacklist API now supports system scope and default roles.
"get_blacklist": "role:reader and system_scope:all"
# DEPRECATED
# "get_blacklist":"rule:admin" has been deprecated since W in favor of
# "get_blacklist":"role:reader and system_scope:all".
# The blacklist API now supports system scope and default roles.
"update_blacklist": "role:admin and system_scope:all"
# DEPRECATED
# "update_blacklist":"rule:admin" has been deprecated since W in favor
# of "update_blacklist":"role:admin and system_scope:all".
# The blacklist API now supports system scope and default roles.
"delete_blacklist": "role:admin and system_scope:all"
# DEPRECATED
# "delete_blacklist":"rule:admin" has been deprecated since W in favor
# of "delete_blacklist":"role:admin and system_scope:all".
# The blacklist API now supports system scope and default roles.
"use_blacklisted_zone": "role:admin and system_scope:all"
# DEPRECATED
# "use_blacklisted_zone":"rule:admin" has been deprecated since W in
# favor of "use_blacklisted_zone":"role:admin and system_scope:all".
# The blacklist API now supports system scope and default roles.
"all_tenants": "role:admin and system_scope:all"
# DEPRECATED
# "all_tenants":"rule:admin" has been deprecated since W in favor of
# "all_tenants":"role:admin and system_scope:all".
# The designate API now supports system scope and default roles.
"edit_managed_records": "role:admin and system_scope:all"
# DEPRECATED
# "edit_managed_records":"rule:admin" has been deprecated since W in
# favor of "edit_managed_records":"role:admin and system_scope:all".
# The designate API now supports system scope and default roles.
"use_low_ttl": "role:admin and system_scope:all"
# DEPRECATED
# "use_low_ttl":"rule:admin" has been deprecated since W in favor of
# "use_low_ttl":"role:admin and system_scope:all".
# The designate API now supports system scope and default roles.
"use_sudo": "role:admin and system_scope:all"
# DEPRECATED
# "use_sudo":"rule:admin" has been deprecated since W in favor of
# "use_sudo":"role:admin and system_scope:all".
# The designate API now supports system scope and default roles.
"create_pool": "role:admin and system_scope:all"
# DEPRECATED
# "create_pool":"rule:admin" has been deprecated since W in favor of
# "create_pool":"role:admin and system_scope:all".
# The pool API now supports system scope and default roles.
"find_pools": "role:reader and system_scope:all"
# DEPRECATED
# "find_pools":"rule:admin" has been deprecated since W in favor of
# "find_pools":"role:reader and system_scope:all".
# The pool API now supports system scope and default roles.
"find_pool": "role:reader and system_scope:all"
# DEPRECATED
# "find_pool":"rule:admin" has been deprecated since W in favor of
# "find_pool":"role:reader and system_scope:all".
# The pool API now supports system scope and default roles.
"get_pool": "role:reader and system_scope:all"
# DEPRECATED
# "get_pool":"rule:admin" has been deprecated since W in favor of
# "get_pool":"role:reader and system_scope:all".
# The pool API now supports system scope and default roles.
"update_pool": "role:admin and system_scope:all"
# DEPRECATED
# "update_pool":"rule:admin" has been deprecated since W in favor of
# "update_pool":"role:admin and system_scope:all".
# The pool API now supports system scope and default roles.
"delete_pool": "role:admin and system_scope:all"
# DEPRECATED
# "delete_pool":"rule:admin" has been deprecated since W in favor of
# "delete_pool":"role:admin and system_scope:all".
# The pool API now supports system scope and default roles.
"zone_create_forced_pool": "role:admin and system_scope:all"
# DEPRECATED
# "zone_create_forced_pool":"rule:admin" has been deprecated since W
# in favor of "zone_create_forced_pool":"role:admin and
# system_scope:all".
# The pool API now supports system scope and default roles.
"get_quotas": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or (True:%(all_tenants)s and role:reader)"
# DEPRECATED
# "get_quotas":"rule:admin_or_owner" has been deprecated since W in
# favor of "get_quotas":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s) or (True:%(all_tenants)s
# and role:reader)".
# The quota API now supports system scope and default roles.
"set_quota": "role:admin and system_scope:all"
# DEPRECATED
# "set_quota":"rule:admin" has been deprecated since W in favor of
# "set_quota":"role:admin and system_scope:all".
# The quota API now supports system scope and default roles.
"reset_quotas": "role:admin and system_scope:all"
# DEPRECATED
# "reset_quotas":"rule:admin" has been deprecated since W in favor of
# "reset_quotas":"role:admin and system_scope:all".
# The quota API now supports system scope and default roles.
"find_records": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "find_records":"rule:admin_or_owner" has been deprecated since W in
# favor of "find_records":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The records API now supports system scope and default roles.
"count_records": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "count_records":"rule:admin_or_owner" has been deprecated since W in
# favor of "count_records":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The records API now supports system scope and default roles.
"create_recordset": "(role:member and project_id:%(project_id)s) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)"
# DEPRECATED
# "create_recordset":"('PRIMARY':%(zone_type)s and
# rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND
# is_admin:True)" has been deprecated since W in favor of
# "create_recordset":"(role:member and project_id:%(project_id)s) and
# ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and
# ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and
# ('SECONDARY':%(zone_type)s)".
# The record set API now supports system scope and default roles.
"get_recordsets": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "get_recordsets":"rule:admin_or_owner" has been deprecated since W
# in favor of "get_recordsets":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The record set API now supports system scope and default roles.
"get_recordset": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "get_recordset":"rule:admin_or_owner" has been deprecated since W in
# favor of "get_recordset":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The record set API now supports system scope and default roles.
"find_recordset": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "find_recordset":"rule:admin_or_owner" has been deprecated since W
# in favor of "find_recordset":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The record set API now supports system scope and default roles.
"find_recordsets": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "find_recordsets":"rule:admin_or_owner" has been deprecated since W
# in favor of "find_recordsets":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The record set API now supports system scope and default roles.
"update_recordset": "(role:member and project_id:%(project_id)s) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)"
# DEPRECATED
# "update_recordset":"('PRIMARY':%(zone_type)s and
# rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND
# is_admin:True)" has been deprecated since W in favor of
# "update_recordset":"(role:member and project_id:%(project_id)s) and
# ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and
# ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and
# ('SECONDARY':%(zone_type)s)".
# The record set API now supports system scope and default roles.
"delete_recordset": "(role:member and project_id:%(project_id)s) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and ('SECONDARY':%(zone_type)s)"
# DEPRECATED
# "delete_recordset":"('PRIMARY':%(zone_type)s and
# rule:admin_or_owner) OR ('SECONDARY':%(zone_type)s AND
# is_admin:True)" has been deprecated since W in favor of
# "delete_recordset":"(role:member and project_id:%(project_id)s) and
# ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and
# ('PRIMARY':%(zone_type)s) or (role:admin and system_scope:all) and
# ('SECONDARY':%(zone_type)s)".
# The record set API now supports system scope and default roles.
"count_recordset": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "count_recordset":"rule:admin_or_owner" has been deprecated since W
# in favor of "count_recordset":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The record set API now supports system scope and default roles.
"find_service_status": "role:reader and system_scope:all"
# DEPRECATED
# "find_service_status":"rule:admin" has been deprecated since W in
# favor of "find_service_status":"role:reader and system_scope:all".
# The service status API now supports system scope and default roles.
"find_service_statuses": "role:reader and system_scope:all"
# DEPRECATED
# "find_service_statuses":"rule:admin" has been deprecated since W in
# favor of "find_service_statuses":"role:reader and system_scope:all".
# The service status API now supports system scope and default roles.
"update_service_status": "role:admin and system_scope:all"
# DEPRECATED
# "update_service_status":"rule:admin" has been deprecated since W in
# favor of "update_service_status":"role:admin and system_scope:all".
# The service status API now supports system scope and default roles.
"find_tenants": "role:reader and system_scope:all"
# DEPRECATED
# "find_tenants":"rule:admin" has been deprecated since W in favor of
# "find_tenants":"role:reader and system_scope:all".
# The tenant API now supports system scope and default roles.
"get_tenant": "role:reader and system_scope:all"
# DEPRECATED
# "get_tenant":"rule:admin" has been deprecated since W in favor of
# "get_tenant":"role:reader and system_scope:all".
# The tenant API now supports system scope and default roles.
"count_tenants": "role:reader and system_scope:all"
# DEPRECATED
# "count_tenants":"rule:admin" has been deprecated since W in favor of
# "count_tenants":"role:reader and system_scope:all".
# The tenant API now supports system scope and default roles.
"create_tld": "role:admin and system_scope:all"
# DEPRECATED
# "create_tld":"rule:admin" has been deprecated since W in favor of
# "create_tld":"role:admin and system_scope:all".
# The top-level domain API now supports system scope and default
# roles.
"find_tlds": "role:reader and system_scope:all"
# DEPRECATED
# "find_tlds":"rule:admin" has been deprecated since W in favor of
# "find_tlds":"role:reader and system_scope:all".
# The top-level domain API now supports system scope and default
# roles.
"get_tld": "role:reader and system_scope:all"
# DEPRECATED
# "get_tld":"rule:admin" has been deprecated since W in favor of
# "get_tld":"role:reader and system_scope:all".
# The top-level domain API now supports system scope and default
# roles.
"update_tld": "role:admin and system_scope:all"
# DEPRECATED
# "update_tld":"rule:admin" has been deprecated since W in favor of
# "update_tld":"role:admin and system_scope:all".
# The top-level domain API now supports system scope and default
# roles.
"delete_tld": "role:admin and system_scope:all"
# DEPRECATED
# "delete_tld":"rule:admin" has been deprecated since W in favor of
# "delete_tld":"role:admin and system_scope:all".
# The top-level domain API now supports system scope and default
# roles.
"create_tsigkey": "role:admin and system_scope:all"
# DEPRECATED
# "create_tsigkey":"rule:admin" has been deprecated since W in favor
# of "create_tsigkey":"role:admin and system_scope:all".
# The tsigkey API now supports system scope and default roles.
"find_tsigkeys": "role:reader and system_scope:all"
# DEPRECATED
# "find_tsigkeys":"rule:admin" has been deprecated since W in favor of
# "find_tsigkeys":"role:reader and system_scope:all".
# The tsigkey API now supports system scope and default roles.
"get_tsigkey": "role:reader and system_scope:all"
# DEPRECATED
# "get_tsigkey":"rule:admin" has been deprecated since W in favor of
# "get_tsigkey":"role:reader and system_scope:all".
# The tsigkey API now supports system scope and default roles.
"update_tsigkey": "role:admin and system_scope:all"
# DEPRECATED
# "update_tsigkey":"rule:admin" has been deprecated since W in favor
# of "update_tsigkey":"role:admin and system_scope:all".
# The tsigkey API now supports system scope and default roles.
"delete_tsigkey": "role:admin and system_scope:all"
# DEPRECATED
# "delete_tsigkey":"rule:admin" has been deprecated since W in favor
# of "delete_tsigkey":"role:admin and system_scope:all".
# The tsigkey API now supports system scope and default roles.
"create_zone": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "create_zone":"rule:admin_or_owner" has been deprecated since W in
# favor of "create_zone":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"get_zones": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "get_zones":"rule:admin_or_owner" has been deprecated since W in
# favor of "get_zones":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"get_zone": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "get_zone":"rule:admin_or_owner" has been deprecated since W in
# favor of "get_zone":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"get_zone_servers": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "get_zone_servers":"rule:admin_or_owner" has been deprecated since W
# in favor of "get_zone_servers":"(role:reader and system_scope:all)
# or (role:reader and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"get_zone_ns_records": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "get_zone_ns_records":"rule:admin_or_owner" has been deprecated
# since W in favor of "get_zone_ns_records":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"find_zones": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "find_zones":"rule:admin_or_owner" has been deprecated since W in
# favor of "find_zones":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"update_zone": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "update_zone":"rule:admin_or_owner" has been deprecated since W in
# favor of "update_zone":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"delete_zone": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "delete_zone":"rule:admin_or_owner" has been deprecated since W in
# favor of "delete_zone":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"xfr_zone": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "xfr_zone":"rule:admin_or_owner" has been deprecated since W in
# favor of "xfr_zone":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"abandon_zone": "role:admin and system_scope:all"
# DEPRECATED
# "abandon_zone":"rule:admin" has been deprecated since W in favor of
# "abandon_zone":"role:admin and system_scope:all".
# The zone API now supports system scope and default roles.
"count_zones": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "count_zones":"rule:admin_or_owner" has been deprecated since W in
# favor of "count_zones":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"count_zones_pending_notify": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "count_zones_pending_notify":"rule:admin_or_owner" has been
# deprecated since W in favor of
# "count_zones_pending_notify":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The zone API now supports system scope and default roles.
"purge_zones": "role:admin and system_scope:all"
# DEPRECATED
# "purge_zones":"rule:admin" has been deprecated since W in favor of
# "purge_zones":"role:admin and system_scope:all".
# The zone API now supports system scope and default roles.
"zone_export": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "zone_export":"rule:admin_or_owner" has been deprecated since W in
# favor of "zone_export":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The zone export API now supports system scope and default roles.
"create_zone_export": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "create_zone_export":"rule:admin_or_owner" has been deprecated since
# W in favor of "create_zone_export":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The zone export API now supports system scope and default roles.
"find_zone_exports": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "find_zone_exports":"rule:admin_or_owner" has been deprecated since
# W in favor of "find_zone_exports":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The zone export API now supports system scope and default roles.
"get_zone_export": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "get_zone_export":"rule:admin_or_owner" has been deprecated since W
# in favor of "get_zone_export":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The zone export API now supports system scope and default roles.
"update_zone_export": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "update_zone_export":"rule:admin_or_owner" has been deprecated since
# W in favor of "update_zone_export":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The zone export API now supports system scope and default roles.
"delete_zone_export": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "delete_zone_export":"rule:admin_or_owner" has been deprecated since
# W in favor of "delete_zone_export":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The zone export API now supports system scope and default roles.
"create_zone_import": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "create_zone_import":"rule:admin_or_owner" has been deprecated since
# W in favor of "create_zone_import":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The zone import API now supports system scope and default roles.
"find_zone_imports": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "find_zone_imports":"rule:admin_or_owner" has been deprecated since
# W in favor of "find_zone_imports":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The zone import API now supports system scope and default roles.
"get_zone_import": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "get_zone_import":"rule:admin_or_owner" has been deprecated since W
# in favor of "get_zone_import":"(role:reader and system_scope:all) or
# (role:reader and project_id:%(project_id)s)".
# The zone import API now supports system scope and default roles.
"update_zone_import": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "update_zone_import":"rule:admin_or_owner" has been deprecated since
# W in favor of "update_zone_import":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The zone import API now supports system scope and default roles.
"delete_zone_import": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "delete_zone_import":"rule:admin_or_owner" has been deprecated since
# W in favor of "delete_zone_import":"(role:admin and
# system_scope:all) or (role:member and project_id:%(project_id)s)".
# The zone import API now supports system scope and default roles.
"create_zone_transfer_accept": "((role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)) or project_id:%(target_project_id)s or None:%(target_project_id)s"
# DEPRECATED
# "create_zone_transfer_accept":"rule:admin_or_owner OR
# project_id:%(target_tenant_id)s OR None:%(target_tenant_id)s" has
# been deprecated since W in favor of
# "create_zone_transfer_accept":"((role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)) or
# project_id:%(target_project_id)s or None:%(target_project_id)s".
# The zone transfer accept API now supports system scope and default
# roles.
"get_zone_transfer_accept": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "get_zone_transfer_accept":"rule:admin_or_owner" has been deprecated
# since W in favor of "get_zone_transfer_accept":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The zone transfer accept API now supports system scope and default
# roles.
"find_zone_transfer_accepts": "role:reader and system_scope:all"
# DEPRECATED
# "find_zone_transfer_accepts":"rule:admin" has been deprecated since
# W in favor of "find_zone_transfer_accepts":"role:reader and
# system_scope:all".
# The zone transfer accept API now supports system scope and default
# roles.
"create_zone_transfer_request": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "create_zone_transfer_request":"rule:admin_or_owner" has been
# deprecated since W in favor of
# "create_zone_transfer_request":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The zone transfer request API now supports system scope and default
# roles.
"get_zone_transfer_request": "((role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)) or project_id:%(target_project_id)s or None:%(target_project_id)s"
# DEPRECATED
# "get_zone_transfer_request":"rule:admin_or_owner OR
# project_id:%(target_tenant_id)s OR None:%(target_tenant_id)s" has
# been deprecated since W in favor of
# "get_zone_transfer_request":"((role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)) or
# project_id:%(target_project_id)s or None:%(target_project_id)s".
# The zone transfer request API now supports system scope and default
# roles.
"get_zone_transfer_request_detailed": "(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)"
# DEPRECATED
# "create_zone_transfer_request":"rule:admin_or_owner" has been
# deprecated since W in favor of
# "get_zone_transfer_request_detailed":"(role:reader and
# system_scope:all) or (role:reader and project_id:%(project_id)s)".
# The zone transfer request API now supports system scope and default
# roles.
# WARNING: A rule name change has been identified.
# This may be an artifact of new rules being
# included which require legacy fallback
# rules to ensure proper policy behavior.
# Alternatively, this may just be an alias.
# Please evaluate on a case by case basis
# keeping in mind the format for aliased
# rules is:
# "old_rule_name": "new_rule_name".
# "create_zone_transfer_request": "rule:get_zone_transfer_request_detailed"
"find_zone_transfer_requests": "@"
"update_zone_transfer_request": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "update_zone_transfer_request":"rule:admin_or_owner" has been
# deprecated since W in favor of
# "update_zone_transfer_request":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The zone transfer request API now supports system scope and default
# roles.
"delete_zone_transfer_request": "(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)"
# DEPRECATED
# "delete_zone_transfer_request":"rule:admin_or_owner" has been
# deprecated since W in favor of
# "delete_zone_transfer_request":"(role:admin and system_scope:all) or
# (role:member and project_id:%(project_id)s)".
# The zone transfer request API now supports system scope and default
# roles.