diff --git a/etc/cinder/policy.json b/etc/cinder/policy.json index 88183720517..7bb9cb164a7 100644 --- a/etc/cinder/policy.json +++ b/etc/cinder/policy.json @@ -1,9 +1,8 @@ { - "context_is_admin": "role:admin", - "admin_or_owner": "is_admin:True or project_id:%(project_id)s", + "admin_or_owner": "is_admin:True or (role:admin and is_admin_project:True) or project_id:%(project_id)s", "default": "rule:admin_or_owner", - "admin_api": "is_admin:True", + "admin_api": "is_admin:True or (role:admin and is_admin_project:True)", "volume:create": "", "volume:delete": "rule:admin_or_owner",