
from oslo_policy import policy

from keystone.common.policies import base

ec2_credential_policies = [
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_get_credential',
        check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_list_credentials',
        check_str=base.RULE_ADMIN_REQUIRED),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_create_credential',
        check_str=base.RULE_ADMIN_REQUIRED),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_delete_credential',
        check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER),
]


def list_rules():
    return ec2_credential_policies


from oslo_policy import policy

from keystone.common.policies import base

ec2_credential_policies = [
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_get_credential',
        check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_list_credentials',
        check_str=base.RULE_ADMIN_OR_OWNER),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_create_credential',
        check_str=base.RULE_ADMIN_OR_OWNER),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_delete_credential',
        check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER),
]


def list_rules():
    return ec2_credential_policies

Set the correct in-code policy for ec2 operations
Set the correct in-code policy for ec2 operations

In I8bd0fa342cdfee00acd3c7a33f7232fe0a87e23f we moved some of the policy
defaults into code. Some of the policy were accidentally changed.

Change-Id: Ib744317025d928c7397ab00dc706172592a9abaf
Closes-Bug: #1675377

  
  from oslo_policy import policy
  
  from keystone.common.policies import base
  
  ec2_credential_policies = [
      policy.RuleDefault(
          name=base.IDENTITY % 'ec2_get_credential',
          check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER),
      policy.RuleDefault(
          name=base.IDENTITY % 'ec2_list_credentials',
-         check_str=base.RULE_ADMIN_REQUIRED),
+         check_str=base.RULE_ADMIN_OR_OWNER),
      policy.RuleDefault(
          name=base.IDENTITY % 'ec2_create_credential',
-         check_str=base.RULE_ADMIN_REQUIRED),
+         check_str=base.RULE_ADMIN_OR_OWNER),
      policy.RuleDefault(
          name=base.IDENTITY % 'ec2_delete_credential',
          check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER),
  ]
  
  
  def list_rules():
      return ec2_credential_policies
  
Set the correct in-code policy for ec2 operations
## Code Before:

from oslo_policy import policy

from keystone.common.policies import base

ec2_credential_policies = [
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_get_credential',
        check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_list_credentials',
        check_str=base.RULE_ADMIN_REQUIRED),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_create_credential',
        check_str=base.RULE_ADMIN_REQUIRED),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_delete_credential',
        check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER),
]


def list_rules():
    return ec2_credential_policies

## Instruction:
Set the correct in-code policy for ec2 operations
## Code After:

from oslo_policy import policy

from keystone.common.policies import base

ec2_credential_policies = [
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_get_credential',
        check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_list_credentials',
        check_str=base.RULE_ADMIN_OR_OWNER),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_create_credential',
        check_str=base.RULE_ADMIN_OR_OWNER),
    policy.RuleDefault(
        name=base.IDENTITY % 'ec2_delete_credential',
        check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER),
]


def list_rules():
    return ec2_credential_policies
