Hi, Where I can get a complete list of policy.json options? I also noticed the policy.json file but couldn't find a documentation for it. I also wanted to restrict the viewership of the servers to the owner_user, project_admin and admin only. So he can access/change the other users' instances. Regards, Vaibhav <blockquote> ---------- Original message ---------- From:"Eoghan Glynn"< eglynn@redhat.com > Date: 25 Mar 13 18:21:48 Subject: Re: [rhos-list] Control Access to instance termination To: Kumar Vaibhav <vaibhav.k.agarwal@in.com> Cc: rhos-list <rhos-list@redhat.com> > Hi, > > I want to restrict the user to see other user's instances. > > Default behaviour is that a user can see all the servers in his > tenant-id. > > He can suspend, delete, pause etc to the instances created by the > other users. > > Can this be restrict ed? I want the full previlige to the owner(user > who created the instance) of the instance. And no privilige to the > other users (except admin) on other users' instances. > > I don't want to create a tenant for each user to solve this problem. > > Regards, > Vaibhav This is a requirement that would ideally be handled via the rules-based access control (RBAC) logic. Currently in nova, a rule such as: "admin_or_owner": "is_admin:True or project_id:%(project_id)s" can be used to specify that an action is restricted to the admin role or the tenant owning the resource. What you would need I believe is a rule like: "admin_or_user": "is_admin:True or user_id:%(user_id)s", then restrict the instance delete etc. actions via: "compute:delete": "rule:admin_or_user", # ... etc. All changes applied to /etc/nova/policy.json followed by: # serv ice openstack-nova-api restart I've tested briefly against master upstream, but I'd be interested hearing your experience with the RHOS version you've got deployed. Cheers, Eoghan </blockquote> <div style="border-top:1px dashed #ccc; border-bottom:1px dashed #ccc; padding:5px;"><a href="http://www3.in.com/sso/commonregister.php?ref=IN&utm_source=invite&utm_medium=outgoing" style="font:13px arial; color:#1E56A1; text-decoration:none;">Get Yourself a cool, short @in.com Email ID now!</a></div>