Warning
JSON formatted policy file is deprecated since Neutron 18.0.0 (Wallaby). This oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.
Neutron, like most OpenStack projects, uses a policy language to restrict permissions on REST API actions.
The following is an overview of all available policies in neutron.
For a sample policy file, refer to Sample Policy File.
context_is_admin
role:admin
Rule for cloud admin access
owner
tenant_id:%(tenant_id)s
Rule for resource owner access
admin_or_owner
rule:context_is_admin or rule:owner
Rule for admin or owner access
context_is_advsvc
role:advsvc
Rule for advsvc role access
admin_or_network_owner
rule:context_is_admin or tenant_id:%(network:tenant_id)s
Rule for admin or network owner access
admin_owner_or_network_owner
rule:owner or rule:admin_or_network_owner
Rule for resource owner, admin or network owner access
network_owner
tenant_id:%(network:tenant_id)s
Rule for network owner access
admin_only
rule:context_is_admin
Rule for admin-only access
regular_user
<empty string>
Rule for regular user access
shared
field:networks:shared=True
Rule of shared network
default
rule:admin_or_owner
Default access rule
admin_or_ext_parent_owner
rule:context_is_admin or tenant_id:%(ext_parent:tenant_id)s
Rule for common parent owner check
ext_parent_owner
tenant_id:%(ext_parent:tenant_id)s
Rule for common parent owner check
sg_owner
tenant_id:%(security_group:tenant_id)s
Rule for security group owner access
shared_address_groups
field:address_groups:shared=True
Definition of a shared address group
get_address_group
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or rule:shared_address_groups
GET /address-groups
GET /address-groups/{id}
system
project
Get an address group
shared_address_scopes
field:address_scopes:shared=True
Definition of a shared address scope
create_address_scope
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /address-scopes
system
project
Create an address scope
create_address_scope:shared
role:admin and system_scope:all
POST /address-scopes
system
project
Create a shared address scope
get_address_scope
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or rule:shared_address_scopes
GET /address-scopes
GET /address-scopes/{id}
system
project
Get an address scope
update_address_scope
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /address-scopes/{id}
system
project
Update an address scope
update_address_scope:shared
role:admin and system_scope:all
PUT /address-scopes/{id}
system
project
Update shared
attribute of an address scope
delete_address_scope
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /address-scopes/{id}
system
project
Delete an address scope
get_agent
role:reader and system_scope:all
GET /agents
GET /agents/{id}
system
Get an agent
update_agent
role:admin and system_scope:all
PUT /agents/{id}
system
Update an agent
delete_agent
role:admin and system_scope:all
DELETE /agents/{id}
system
Delete an agent
create_dhcp-network
role:admin and system_scope:all
POST /agents/{agent_id}/dhcp-networks
system
Add a network to a DHCP agent
get_dhcp-networks
role:reader and system_scope:all
GET /agents/{agent_id}/dhcp-networks
system
List networks on a DHCP agent
delete_dhcp-network
role:admin and system_scope:all
DELETE /agents/{agent_id}/dhcp-networks/{network_id}
system
Remove a network from a DHCP agent
create_l3-router
role:admin and system_scope:all
POST /agents/{agent_id}/l3-routers
system
Add a router to an L3 agent
get_l3-routers
role:reader and system_scope:all
GET /agents/{agent_id}/l3-routers
system
List routers on an L3 agent
delete_l3-router
role:admin and system_scope:all
DELETE /agents/{agent_id}/l3-routers/{router_id}
system
Remove a router from an L3 agent
get_dhcp-agents
role:reader and system_scope:all
GET /networks/{network_id}/dhcp-agents
system
List DHCP agents hosting a network
get_l3-agents
role:reader and system_scope:all
GET /routers/{router_id}/l3-agents
system
List L3 agents hosting a router
get_auto_allocated_topology
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /auto-allocated-topology/{project_id}
system
project
Get a project’s auto-allocated topology
delete_auto_allocated_topology
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /auto-allocated-topology/{project_id}
system
project
Delete a project’s auto-allocated topology
get_availability_zone
role:reader and system_scope:all
GET /availability_zones
system
List availability zones
create_flavor
role:admin and system_scope:all
POST /flavors
system
Create a flavor
get_flavor
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /flavors
GET /flavors/{id}
system
project
Get a flavor
update_flavor
role:admin and system_scope:all
PUT /flavors/{id}
system
Update a flavor
delete_flavor
role:admin and system_scope:all
DELETE /flavors/{id}
system
Delete a flavor
create_service_profile
role:admin and system_scope:all
POST /service_profiles
system
Create a service profile
get_service_profile
role:reader and system_scope:all
GET /service_profiles
GET /service_profiles/{id}
system
Get a service profile
update_service_profile
role:admin and system_scope:all
PUT /service_profiles/{id}
system
Update a service profile
delete_service_profile
role:admin and system_scope:all
DELETE /service_profiles/{id}
system
Delete a service profile
get_flavor_service_profile
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
system
project
Get a flavor associated with a given service profiles. There is no corresponding GET operations in API currently. This rule is currently referred only in the DELETE of flavor_service_profile.
create_flavor_service_profile
role:admin and system_scope:all
POST /flavors/{flavor_id}/service_profiles
system
Associate a flavor with a service profile
delete_flavor_service_profile
role:admin and system_scope:all
DELETE /flavors/{flavor_id}/service_profiles/{profile_id}
system
Disassociate a flavor with a service profile
create_floatingip
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /floatingips
system
project
Create a floating IP
create_floatingip:floating_ip_address
role:admin and system_scope:all
POST /floatingips
system
project
Create a floating IP with a specific IP address
get_floatingip
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /floatingips
GET /floatingips/{id}
system
project
Get a floating IP
update_floatingip
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /floatingips/{id}
system
project
Update a floating IP
delete_floatingip
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /floatingips/{id}
system
project
Delete a floating IP
get_floatingip_pool
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /floatingip_pools
system
project
Get floating IP pools
create_floatingip_port_forwarding
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:ext_parent_owner
POST /floatingips/{floatingip_id}/port_forwardings
system
project
Create a floating IP port forwarding
get_floatingip_port_forwarding
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or rule:ext_parent_owner
GET /floatingips/{floatingip_id}/port_forwardings
GET /floatingips/{floatingip_id}/port_forwardings/{port_forwarding_id}
system
project
Get a floating IP port forwarding
update_floatingip_port_forwarding
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:ext_parent_owner
PUT /floatingips/{floatingip_id}/port_forwardings/{port_forwarding_id}
system
project
Update a floating IP port forwarding
delete_floatingip_port_forwarding
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:ext_parent_owner
DELETE /floatingips/{floatingip_id}/port_forwardings/{port_forwarding_id}
system
project
Delete a floating IP port forwarding
create_router_conntrack_helper
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:ext_parent_owner
POST /routers/{router_id}/conntrack_helpers
system
project
Create a router conntrack helper
get_router_conntrack_helper
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or rule:ext_parent_owner
GET /routers/{router_id}/conntrack_helpers
GET /routers/{router_id}/conntrack_helpers/{conntrack_helper_id}
system
project
Get a router conntrack helper
update_router_conntrack_helper
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:ext_parent_owner
PUT /routers/{router_id}/conntrack_helpers/{conntrack_helper_id}
system
project
Update a router conntrack helper
delete_router_conntrack_helper
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:ext_parent_owner
DELETE /routers/{router_id}/conntrack_helpers/{conntrack_helper_id}
system
project
Delete a router conntrack helper
get_loggable_resource
role:reader and system_scope:all
GET /log/loggable-resources
system
Get loggable resources
create_log
role:admin and system_scope:all
POST /log/logs
system
Create a network log
get_log
role:reader and system_scope:all
GET /log/logs
GET /log/logs/{id}
system
Get a network log
update_log
role:admin and system_scope:all
PUT /log/logs/{id}
system
Update a network log
delete_log
role:admin and system_scope:all
DELETE /log/logs/{id}
system
Delete a network log
create_metering_label
role:admin and system_scope:all
POST /metering/metering-labels
system
project
Create a metering label
get_metering_label
role:reader and system_scope:all
GET /metering/metering-labels
GET /metering/metering-labels/{id}
system
project
Get a metering label
delete_metering_label
role:admin and system_scope:all
DELETE /metering/metering-labels/{id}
system
project
Delete a metering label
create_metering_label_rule
role:admin and system_scope:all
POST /metering/metering-label-rules
system
project
Create a metering label rule
get_metering_label_rule
role:reader and system_scope:all
GET /metering/metering-label-rules
GET /metering/metering-label-rules/{id}
system
project
Get a metering label rule
delete_metering_label_rule
role:admin and system_scope:all
DELETE /metering/metering-label-rules/{id}
system
project
Delete a metering label rule
external
field:networks:router:external=True
Definition of an external network
create_network
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /networks
system
project
Create a network
create_network:shared
role:admin and system_scope:all
POST /networks
system
Create a shared network
create_network:router:external
role:admin and system_scope:all
POST /networks
system
Create an external network
create_network:is_default
role:admin and system_scope:all
POST /networks
system
Specify is_default
attribute when creating a network
create_network:port_security_enabled
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /networks
system
project
Specify port_security_enabled
attribute when creating a network
create_network:segments
role:admin and system_scope:all
POST /networks
system
Specify segments
attribute when creating a network
create_network:provider:network_type
role:admin and system_scope:all
POST /networks
system
Specify provider:network_type
when creating a network
create_network:provider:physical_network
role:admin and system_scope:all
POST /networks
system
Specify provider:physical_network
when creating a network
create_network:provider:segmentation_id
role:admin and system_scope:all
POST /networks
system
Specify provider:segmentation_id
when creating a network
get_network
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or rule:shared or rule:external or rule:context_is_advsvc
GET /networks
GET /networks/{id}
system
project
Get a network
get_network:router:external
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /networks
GET /networks/{id}
system
project
Get router:external
attribute of a network
get_network:segments
role:reader and system_scope:all
GET /networks
GET /networks/{id}
system
Get segments
attribute of a network
get_network:provider:network_type
role:reader and system_scope:all
GET /networks
GET /networks/{id}
system
Get provider:network_type
attribute of a network
get_network:provider:physical_network
role:reader and system_scope:all
GET /networks
GET /networks/{id}
system
Get provider:physical_network
attribute of a network
get_network:provider:segmentation_id
role:reader and system_scope:all
GET /networks
GET /networks/{id}
system
Get provider:segmentation_id
attribute of a network
update_network
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /networks/{id}
system
project
Update a network
update_network:segments
role:admin and system_scope:all
PUT /networks/{id}
system
Update segments
attribute of a network
update_network:shared
role:admin and system_scope:all
PUT /networks/{id}
system
Update shared
attribute of a network
update_network:provider:network_type
role:admin and system_scope:all
PUT /networks/{id}
system
Update provider:network_type
attribute of a network
update_network:provider:physical_network
role:admin and system_scope:all
PUT /networks/{id}
system
Update provider:physical_network
attribute of a network
update_network:provider:segmentation_id
role:admin and system_scope:all
PUT /networks/{id}
system
Update provider:segmentation_id
attribute of a network
update_network:router:external
role:admin and system_scope:all
PUT /networks/{id}
system
Update router:external
attribute of a network
update_network:is_default
role:admin and system_scope:all
PUT /networks/{id}
system
Update is_default
attribute of a network
update_network:port_security_enabled
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /networks/{id}
system
project
Update port_security_enabled
attribute of a network
delete_network
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /networks/{id}
system
project
Delete a network
get_network_ip_availability
role:reader and system_scope:all
GET /network-ip-availabilities
GET /network-ip-availabilities/{network_id}
system
Get network IP availability
create_network_segment_range
role:admin and system_scope:all
POST /network_segment_ranges
system
Create a network segment range
get_network_segment_range
role:reader and system_scope:all
GET /network_segment_ranges
GET /network_segment_ranges/{id}
system
Get a network segment range
update_network_segment_range
role:admin and system_scope:all
PUT /network_segment_ranges/{id}
system
Update a network segment range
delete_network_segment_range
role:admin and system_scope:all
DELETE /network_segment_ranges/{id}
system
Delete a network segment range
network_device
field:port:device_owner=~^network:
Definition of port with network device_owner
admin_or_data_plane_int
rule:context_is_admin or role:data_plane_integrator
Rule for data plane integration
create_port
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /ports
system
project
Create a port
create_port:device_owner
not rule:network_device or role:admin and system_scope:all or role:admin and project_id:%(project_id)s or rule:context_is_advsvc or rule:network_owner
POST /ports
system
project
Specify device_owner
attribute when creting a port
create_port:mac_address
rule:context_is_advsvc or rule:network_owner or role:admin and system_scope:all or role:admin and project_id:%(project_id)s
POST /ports
system
project
Specify mac_address
attribute when creating a port
create_port:fixed_ips
rule:context_is_advsvc or rule:network_owner or role:admin and system_scope:all or role:admin and project_id:%(project_id)s or rule:shared
POST /ports
system
project
Specify fixed_ips
information when creating a port
create_port:fixed_ips:ip_address
rule:context_is_advsvc or rule:network_owner or role:admin and system_scope:all or role:admin and project_id:%(project_id)s
POST /ports
system
project
Specify IP address in fixed_ips
when creating a port
create_port:fixed_ips:subnet_id
rule:context_is_advsvc or rule:network_owner or role:admin and system_scope:all or role:admin and project_id:%(project_id)s or rule:shared
POST /ports
system
project
Specify subnet ID in fixed_ips
when creating a port
create_port:port_security_enabled
rule:context_is_advsvc or rule:network_owner or role:admin and system_scope:all or role:admin and project_id:%(project_id)s
POST /ports
system
project
Specify port_security_enabled
attribute when creating a port
create_port:binding:host_id
role:admin and system_scope:all
POST /ports
system
Specify binding:host_id
attribute when creating a port
create_port:binding:profile
role:admin and system_scope:all
POST /ports
system
Specify binding:profile
attribute when creating a port
create_port:binding:vnic_type
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /ports
system
project
Specify binding:vnic_type
attribute when creating a port
create_port:allowed_address_pairs
role:admin and system_scope:all or role:admin and project_id:%(project_id)s or rule:network_owner
POST /ports
project
system
Specify allowed_address_pairs
attribute when creating a port
create_port:allowed_address_pairs:mac_address
role:admin and system_scope:all or role:admin and project_id:%(project_id)s or rule:network_owner
POST /ports
project
system
Specify mac_address` of `allowed_address_pairs
attribute when creating a port
create_port:allowed_address_pairs:ip_address
role:admin and system_scope:all or role:admin and project_id:%(project_id)s or rule:network_owner
POST /ports
project
system
Specify ip_address
of allowed_address_pairs
attribute when creating a port
get_port
rule:context_is_advsvc or (role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /ports
GET /ports/{id}
project
system
Get a port
get_port:binding:vif_type
role:reader and system_scope:all
GET /ports
GET /ports/{id}
system
Get binding:vif_type
attribute of a port
get_port:binding:vif_details
role:reader and system_scope:all
GET /ports
GET /ports/{id}
system
Get binding:vif_details
attribute of a port
get_port:binding:host_id
role:reader and system_scope:all
GET /ports
GET /ports/{id}
system
Get binding:host_id
attribute of a port
get_port:binding:profile
role:reader and system_scope:all
GET /ports
GET /ports/{id}
system
Get binding:profile
attribute of a port
get_port:resource_request
role:reader and system_scope:all
GET /ports
GET /ports/{id}
system
Get resource_request
attribute of a port
update_port
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:context_is_advsvc
PUT /ports/{id}
system
project
Update a port
update_port:device_owner
not rule:network_device or rule:context_is_advsvc or rule:network_owner or role:admin and system_scope:all or role:admin and project_id:%(project_id)s
PUT /ports/{id}
system
project
Update device_owner
attribute of a port
update_port:mac_address
role:admin and system_scope:all or rule:context_is_advsvc
PUT /ports/{id}
system
project
Update mac_address
attribute of a port
update_port:fixed_ips
rule:context_is_advsvc or rule:network_owner or role:admin and system_scope:all or role:admin and project_id:%(project_id)s
PUT /ports/{id}
system
project
Specify fixed_ips
information when updating a port
update_port:fixed_ips:ip_address
rule:context_is_advsvc or rule:network_owner or role:admin and system_scope:all or role:admin and project_id:%(project_id)s
PUT /ports/{id}
system
project
Specify IP address in fixed_ips
information when updating a port
update_port:fixed_ips:subnet_id
rule:context_is_advsvc or rule:network_owner or role:admin and system_scope:all or role:admin and project_id:%(project_id)s or rule:shared
PUT /ports/{id}
system
project
Specify subnet ID in fixed_ips
information when updating a port
update_port:port_security_enabled
rule:context_is_advsvc or rule:network_owner or role:admin and system_scope:all or role:admin and project_id:%(project_id)s
PUT /ports/{id}
system
project
Update port_security_enabled
attribute of a port
update_port:binding:host_id
role:admin and system_scope:all
PUT /ports/{id}
system
Update binding:host_id
attribute of a port
update_port:binding:profile
role:admin and system_scope:all
PUT /ports/{id}
system
Update binding:profile
attribute of a port
update_port:binding:vnic_type
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:context_is_advsvc
PUT /ports/{id}
system
project
Update binding:vnic_type
attribute of a port
update_port:allowed_address_pairs
role:admin and system_scope:all or role:admin and project_id:%(project_id)s or rule:network_owner
PUT /ports/{id}
system
project
Update allowed_address_pairs
attribute of a port
update_port:allowed_address_pairs:mac_address
role:admin and system_scope:all or role:admin and project_id:%(project_id)s or rule:network_owner
PUT /ports/{id}
system
project
Update mac_address
of allowed_address_pairs
attribute of a port
update_port:allowed_address_pairs:ip_address
role:admin and system_scope:all or role:admin and project_id:%(project_id)s or rule:network_owner
PUT /ports/{id}
system
project
Update ip_address
of allowed_address_pairs
attribute of a port
update_port:data_plane_status
role:admin and system_scope:all or role:data_plane_integrator
PUT /ports/{id}
system
project
Update data_plane_status
attribute of a port
delete_port
rule:context_is_advsvc or (role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /ports/{id}
system
project
Delete a port
get_policy
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /qos/policies
GET /qos/policies/{id}
system
project
Get QoS policies
create_policy
role:admin and system_scope:all
POST /qos/policies
system
Create a QoS policy
update_policy
role:admin and system_scope:all
PUT /qos/policies/{id}
system
Update a QoS policy
delete_policy
role:admin and system_scope:all
DELETE /qos/policies/{id}
system
Delete a QoS policy
get_rule_type
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /qos/rule-types
GET /qos/rule-types/{rule_type}
system
project
Get available QoS rule types
get_policy_bandwidth_limit_rule
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /qos/policies/{policy_id}/bandwidth_limit_rules
GET /qos/policies/{policy_id}/bandwidth_limit_rules/{rule_id}
system
project
Get a QoS bandwidth limit rule
create_policy_bandwidth_limit_rule
role:admin and system_scope:all
POST /qos/policies/{policy_id}/bandwidth_limit_rules
system
Create a QoS bandwidth limit rule
update_policy_bandwidth_limit_rule
role:admin and system_scope:all
PUT /qos/policies/{policy_id}/bandwidth_limit_rules/{rule_id}
system
Update a QoS bandwidth limit rule
delete_policy_bandwidth_limit_rule
role:admin and system_scope:all
DELETE /qos/policies/{policy_id}/bandwidth_limit_rules/{rule_id}
system
Delete a QoS bandwidth limit rule
get_policy_dscp_marking_rule
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /qos/policies/{policy_id}/dscp_marking_rules
GET /qos/policies/{policy_id}/dscp_marking_rules/{rule_id}
system
project
Get a QoS DSCP marking rule
create_policy_dscp_marking_rule
role:admin and system_scope:all
POST /qos/policies/{policy_id}/dscp_marking_rules
system
Create a QoS DSCP marking rule
update_policy_dscp_marking_rule
role:admin and system_scope:all
PUT /qos/policies/{policy_id}/dscp_marking_rules/{rule_id}
system
Update a QoS DSCP marking rule
delete_policy_dscp_marking_rule
role:admin and system_scope:all
DELETE /qos/policies/{policy_id}/dscp_marking_rules/{rule_id}
system
Delete a QoS DSCP marking rule
get_policy_minimum_bandwidth_rule
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /qos/policies/{policy_id}/minimum_bandwidth_rules
GET /qos/policies/{policy_id}/minimum_bandwidth_rules/{rule_id}
system
project
Get a QoS minimum bandwidth rule
create_policy_minimum_bandwidth_rule
role:admin and system_scope:all
POST /qos/policies/{policy_id}/minimum_bandwidth_rules
system
Create a QoS minimum bandwidth rule
update_policy_minimum_bandwidth_rule
role:admin and system_scope:all
PUT /qos/policies/{policy_id}/minimum_bandwidth_rules/{rule_id}
system
Update a QoS minimum bandwidth rule
delete_policy_minimum_bandwidth_rule
role:admin and system_scope:all
DELETE /qos/policies/{policy_id}/minimum_bandwidth_rules/{rule_id}
system
Delete a QoS minimum bandwidth rule
get_alias_bandwidth_limit_rule
rule:get_policy_bandwidth_limit_rule
GET /qos/alias_bandwidth_limit_rules/{rule_id}/
Get a QoS bandwidth limit rule through alias
update_alias_bandwidth_limit_rule
rule:update_policy_bandwidth_limit_rule
PUT /qos/alias_bandwidth_limit_rules/{rule_id}/
Update a QoS bandwidth limit rule through alias
delete_alias_bandwidth_limit_rule
rule:delete_policy_bandwidth_limit_rule
DELETE /qos/alias_bandwidth_limit_rules/{rule_id}/
Delete a QoS bandwidth limit rule through alias
get_alias_dscp_marking_rule
rule:get_policy_dscp_marking_rule
GET /qos/alias_dscp_marking_rules/{rule_id}/
Get a QoS DSCP marking rule through alias
update_alias_dscp_marking_rule
rule:update_policy_dscp_marking_rule
PUT /qos/alias_dscp_marking_rules/{rule_id}/
Update a QoS DSCP marking rule through alias
delete_alias_dscp_marking_rule
rule:delete_policy_dscp_marking_rule
DELETE /qos/alias_dscp_marking_rules/{rule_id}/
Delete a QoS DSCP marking rule through alias
get_alias_minimum_bandwidth_rule
rule:get_policy_minimum_bandwidth_rule
GET /qos/alias_minimum_bandwidth_rules/{rule_id}/
Get a QoS minimum bandwidth rule through alias
update_alias_minimum_bandwidth_rule
rule:update_policy_minimum_bandwidth_rule
PUT /qos/alias_minimum_bandwidth_rules/{rule_id}/
Update a QoS minimum bandwidth rule through alias
delete_alias_minimum_bandwidth_rule
rule:delete_policy_minimum_bandwidth_rule
DELETE /qos/alias_minimum_bandwidth_rules/{rule_id}/
Delete a QoS minimum bandwidth rule through alias
get_quota
role:reader and system_scope:all
GET /quota
GET /quota/{id}
system
Get a resource quota
update_quota
role:admin and system_scope:all
PUT /quota/{id}
system
Update a resource quota
delete_quota
role:admin and system_scope:all
DELETE /quota/{id}
system
Delete a resource quota
restrict_wildcard
(not field:rbac_policy:target_tenant=*) or rule:admin_only
Definition of a wildcard target_tenant
create_rbac_policy
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /rbac-policies
system
project
Create an RBAC policy
create_rbac_policy:target_tenant
role:admin and system_scope:all or (not field:rbac_policy:target_tenant=*)
POST /rbac-policies
system
project
Specify target_tenant
when creating an RBAC policy
update_rbac_policy
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /rbac-policies/{id}
project
system
Update an RBAC policy
update_rbac_policy:target_tenant
role:admin and system_scope:all or (not field:rbac_policy:target_tenant=*)
PUT /rbac-policies/{id}
system
project
Update target_tenant
attribute of an RBAC policy
get_rbac_policy
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /rbac-policies
GET /rbac-policies/{id}
project
system
Get an RBAC policy
delete_rbac_policy
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /rbac-policies/{id}
project
system
Delete an RBAC policy
create_router
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /routers
system
project
Create a router
create_router:distributed
role:admin and system_scope:all
POST /routers
system
Specify distributed
attribute when creating a router
create_router:ha
role:admin and system_scope:all
POST /routers
system
Specify ha
attribute when creating a router
create_router:external_gateway_info
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /routers
system
project
Specify external_gateway_info
information when creating a router
create_router:external_gateway_info:network_id
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /routers
system
project
Specify network_id
in external_gateway_info
information when creating a router
create_router:external_gateway_info:enable_snat
role:admin and system_scope:all
POST /routers
system
Specify enable_snat
in external_gateway_info
information when creating a router
create_router:external_gateway_info:external_fixed_ips
role:admin and system_scope:all
POST /routers
system
Specify external_fixed_ips
in external_gateway_info
information when creating a router
get_router
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /routers
GET /routers/{id}
system
project
Get a router
get_router:distributed
role:reader and system_scope:all
GET /routers
GET /routers/{id}
system
Get distributed
attribute of a router
get_router:ha
role:reader and system_scope:all
GET /routers
GET /routers/{id}
system
Get ha
attribute of a router
update_router
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /routers/{id}
system
project
Update a router
update_router:distributed
role:admin and system_scope:all
PUT /routers/{id}
system
Update distributed
attribute of a router
update_router:ha
role:admin and system_scope:all
PUT /routers/{id}
system
Update ha
attribute of a router
update_router:external_gateway_info
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /routers/{id}
system
project
Update external_gateway_info
information of a router
update_router:external_gateway_info:network_id
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /routers/{id}
system
project
Update network_id
attribute of external_gateway_info
information of a router
update_router:external_gateway_info:enable_snat
role:admin and system_scope:all
PUT /routers/{id}
system
Update enable_snat
attribute of external_gateway_info
information of a router
update_router:external_gateway_info:external_fixed_ips
role:admin and system_scope:all
PUT /routers/{id}
system
Update external_fixed_ips
attribute of external_gateway_info
information of a router
delete_router
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /routers/{id}
system
project
Delete a router
add_router_interface
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /routers/{id}/add_router_interface
system
project
Add an interface to a router
remove_router_interface
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /routers/{id}/remove_router_interface
system
project
Remove an interface from a router
add_extraroutes
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /routers/{id}/add_extraroutes
system
project
Add extra route to a router
remove_extraroutes
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /routers/{id}/remove_extraroutes
system
project
Remove extra route from a router
admin_or_sg_owner
rule:context_is_admin or tenant_id:%(security_group:tenant_id)s
Rule for admin or security group owner access
admin_owner_or_sg_owner
rule:owner or rule:admin_or_sg_owner
Rule for resource owner, admin or security group owner access
create_security_group
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /security-groups
system
project
Create a security group
get_security_group
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /security-groups
GET /security-groups/{id}
system
project
Get a security group
update_security_group
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /security-groups/{id}
system
project
Update a security group
delete_security_group
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /security-groups/{id}
system
project
Delete a security group
create_security_group_rule
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /security-group-rules
system
project
Create a security group rule
get_security_group_rule
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or rule:sg_owner
GET /security-group-rules
GET /security-group-rules/{id}
system
project
Get a security group rule
delete_security_group_rule
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /security-group-rules/{id}
system
project
Delete a security group rule
create_segment
role:admin and system_scope:all
POST /segments
system
Create a segment
get_segment
role:reader and system_scope:all
GET /segments
GET /segments/{id}
system
Get a segment
update_segment
role:admin and system_scope:all
PUT /segments/{id}
system
Update a segment
delete_segment
role:admin and system_scope:all
DELETE /segments/{id}
system
Delete a segment
get_service_provider
role:reader
GET /service-providers
system
project
Get service providers
create_subnet
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:network_owner
POST /subnets
system
project
Create a subnet
create_subnet:segment_id
role:admin and system_scope:all
POST /subnets
system
Specify segment_id
attribute when creating a subnet
create_subnet:service_types
role:admin and system_scope:all
POST /subnets
system
Specify service_types
attribute when creating a subnet
get_subnet
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or rule:shared
GET /subnets
GET /subnets/{id}
system
project
Get a subnet
get_subnet:segment_id
role:reader and system_scope:all
GET /subnets
GET /subnets/{id}
system
Get segment_id
attribute of a subnet
update_subnet
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:network_owner
PUT /subnets/{id}
system
project
Update a subnet
update_subnet:segment_id
role:admin and system_scope:all
PUT /subnets/{id}
system
Update segment_id
attribute of a subnet
update_subnet:service_types
role:admin and system_scope:all
PUT /subnets/{id}
system
Update service_types
attribute of a subnet
delete_subnet
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s) or rule:network_owner
DELETE /subnets/{id}
system
project
Delete a subnet
shared_subnetpools
field:subnetpools:shared=True
Definition of a shared subnetpool
create_subnetpool
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /subnetpools
project
system
Create a subnetpool
create_subnetpool:shared
role:admin and system_scope:all
POST /subnetpools
system
Create a shared subnetpool
create_subnetpool:is_default
role:admin and system_scope:all
POST /subnetpools
system
Specify is_default
attribute when creating a subnetpool
get_subnetpool
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s) or rule:shared_subnetpools
GET /subnetpools
GET /subnetpools/{id}
system
project
Get a subnetpool
update_subnetpool
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /subnetpools/{id}
system
project
Update a subnetpool
update_subnetpool:is_default
role:admin and system_scope:all
PUT /subnetpools/{id}
system
Update is_default
attribute of a subnetpool
delete_subnetpool
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /subnetpools/{id}
system
project
Delete a subnetpool
onboard_network_subnets
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /subnetpools/{id}/onboard_network_subnets
system
project
Onboard existing subnet into a subnetpool
add_prefixes
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /subnetpools/{id}/add_prefixes
system
project
Add prefixes to a subnetpool
remove_prefixes
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /subnetpools/{id}/remove_prefixes
system
project
Remove unallocated prefixes from a subnetpool
create_trunk
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
POST /trunks
project
system
Create a trunk
get_trunk
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /trunks
GET /trunks/{id}
project
system
Get a trunk
update_trunk
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /trunks/{id}
project
system
Update a trunk
delete_trunk
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
DELETE /trunks/{id}
project
system
Delete a trunk
get_subports
(role:reader and system_scope:all) or (role:reader and project_id:%(project_id)s)
GET /trunks/{id}/get_subports
project
system
List subports attached to a trunk
add_subports
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /trunks/{id}/add_subports
project
system
Add subports to a trunk
remove_subports
(role:admin and system_scope:all) or (role:member and project_id:%(project_id)s)
PUT /trunks/{id}/remove_subports
project
system
Delete subports from a trunk
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.