Policy configuration

Warning

JSON formatted policy file is deprecated since Barbican 12.0.0 (Wallaby). This oslopolicy-convert-json-to-yaml tool will migrate your existing JSON-formatted policy file to YAML in a backward-compatible way.

Configuration

Note

The auto-generated configuration reference may show the default values of enforce_new_defaults and enforce_scope as True (the oslo.policy library default). However, Barbican overrides both to False at runtime. To opt in to the new secure RBAC defaults, explicitly set both options to True in the [oslo_policy] section of barbican.conf.

The following is an overview of all available policies in Barbican. For a sample configuration file.

barbican

secret_project_match
Default:

project_id:%(target.secret.project_id)s

(no description provided)

secret_project_reader
Default:

role:reader and rule:secret_project_match

(no description provided)

secret_project_member
Default:

role:member and rule:secret_project_match

(no description provided)

secret_project_admin
Default:

role:admin and rule:secret_project_match

(no description provided)

secret_owner
Default:

user_id:%(target.secret.creator_id)s

(no description provided)

secret_is_not_private
Default:

True:%(target.secret.read_project_access)s

(no description provided)

secret_acl_read
Default:

'read':%(target.secret.read)s

(no description provided)

container_project_match
Default:

project_id:%(target.container.project_id)s

(no description provided)

container_project_member
Default:

role:member and rule:container_project_match

(no description provided)

container_project_admin
Default:

role:admin and rule:container_project_match

(no description provided)

container_owner
Default:

user_id:%(target.container.creator_id)s

(no description provided)

container_is_not_private
Default:

True:%(target.container.read_project_access)s

(no description provided)

container_acl_read
Default:

'read':%(target.container.read)s

(no description provided)

order_project_match
Default:

project_id:%(target.order.project_id)s

(no description provided)

order_project_member
Default:

role:member and rule:order_project_match

(no description provided)

audit
Default:

role:audit

(no description provided)

observer
Default:

role:observer

(no description provided)

creator
Default:

role:creator

(no description provided)

admin
Default:

role:admin

(no description provided)

service_admin
Default:

role:key-manager:service-admin

(no description provided)

all_users
Default:

rule:admin or rule:observer or rule:creator or rule:audit or rule:service_admin

(no description provided)

all_but_audit
Default:

rule:admin or rule:observer or rule:creator

(no description provided)

admin_or_creator
Default:

rule:admin or rule:creator

(no description provided)

secret_creator_user
Default:

user_id:%(target.secret.creator_id)s

(no description provided)

secret_private_read
Default:

'False':%(target.secret.read_project_access)s

(no description provided)

secret_non_private_read
Default:

rule:all_users and rule:secret_project_match and not rule:secret_private_read

(no description provided)

secret_decrypt_non_private_read
Default:

rule:all_but_audit and rule:secret_project_match and not rule:secret_private_read

(no description provided)

secret_project_creator
Default:

rule:creator and rule:secret_project_match and rule:secret_creator_user

(no description provided)

secret_project_creator_role
Default:

rule:creator and rule:secret_project_match

(no description provided)

container_private_read
Default:

'False':%(target.container.read_project_access)s

(no description provided)

container_creator_user
Default:

user_id:%(target.container.creator_id)s

(no description provided)

container_non_private_read
Default:

rule:all_users and rule:container_project_match and not rule:container_private_read

(no description provided)

container_project_creator
Default:

rule:creator and rule:container_project_match and rule:container_creator_user

(no description provided)

container_project_creator_role
Default:

rule:creator and rule:container_project_match

(no description provided)

secret_acls:get
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))

Operations:

  • GET /v1/secrets/{secret-id}/acl

Scope Types:

  • project

Retrieve the ACL settings for a given secret. If no ACL is defined for that secret, the default ACL is returned.

secret_acls:delete
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))

Operations:

  • DELETE /v1/secrets/{secret-id}/acl

Scope Types:

  • project

Delete the ACL settings for a given secret.

secret_acls:put_patch
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))

Operations:

  • PUT /v1/secrets/{secret-id}/acl

  • PATCH /v1/secrets/{secret-id}/acl

Scope Types:

  • project

Create a new ACL, or replace or update an existing ACL, for a given secret.

container_acls:get
Default:

True:%(enforce_new_defaults)s and (rule:container_project_admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private))

Operations:

  • GET /v1/containers/{container-id}/acl

Scope Types:

  • project

Retrieve the ACL settings for a given container.

container_acls:delete
Default:

True:%(enforce_new_defaults)s and (rule:container_project_admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private))

Operations:

  • DELETE /v1/containers/{container-id}/acl

Scope Types:

  • project

Delete ACL for a given container. No content is returned in the case of successful deletion.

container_acls:put_patch
Default:

True:%(enforce_new_defaults)s and (rule:container_project_admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private))

Operations:

  • PUT /v1/containers/{container-id}/acl

  • PATCH /v1/containers/{container-id}/acl

Scope Types:

  • project

Create a new ACL, or replace an existing ACL, for a given container.

consumer:get
Default:

True:%(enforce_new_defaults)s and (role:admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private) or rule:container_acl_read)

Operations:

  • GET /v1/containers/{container-id}/consumers/{consumer-id}

Scope Types:

  • project

DEPRECATED: Show information for a specific consumer.

container_consumers:get
Default:

True:%(enforce_new_defaults)s and (rule:container_project_admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private) or rule:container_acl_read)

Operations:

  • GET /v1/containers/{container-id}/consumers

Scope Types:

  • project

List a container’s consumers.

container_consumers:post
Default:

True:%(enforce_new_defaults)s and (rule:container_project_admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private) or rule:container_acl_read)

Operations:

  • POST /v1/containers/{container-id}/consumers

Scope Types:

  • project

Create a consumer.

container_consumers:delete
Default:

True:%(enforce_new_defaults)s and (rule:container_project_admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private) or rule:container_acl_read)

Operations:

  • DELETE /v1/containers/{container-id}/consumers

Scope Types:

  • project

Delete a consumer.

secret_consumers:get
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private) or rule:secret_acl_read)

Operations:

  • GET /v1/secrets/{secret-id}/consumers

Scope Types:

  • project

List consumers for a secret.

secret_consumers:post
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private) or rule:secret_acl_read)

Operations:

  • POST /v1/secrets/{secret-id}/consumers

Scope Types:

  • project

Create a consumer.

secret_consumers:delete
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private) or rule:secret_acl_read)

Operations:

  • DELETE /v1/secrets/{secret-id}/consumers

Scope Types:

  • project

Delete a consumer.

containers:post
Default:

True:%(enforce_new_defaults)s and role:member

Operations:

  • POST /v1/containers

Scope Types:

  • project

Create a container.

containers:get
Default:

True:%(enforce_new_defaults)s and role:member

Operations:

  • GET /v1/containers

Scope Types:

  • project

List a project’s containers.

container:get
Default:

True:%(enforce_new_defaults)s and (rule:container_project_admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private) or rule:container_acl_read)

Operations:

  • GET /v1/containers/{container-id}

Scope Types:

  • project

Retrieve a single container.

container:delete
Default:

True:%(enforce_new_defaults)s and (rule:container_project_admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private))

Operations:

  • DELETE /v1/containers/{container-id}

Scope Types:

  • project

Delete a container.

container_secret:post
Default:

True:%(enforce_new_defaults)s and (rule:container_project_admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private))

Operations:

  • POST /v1/containers/{container-id}/secrets

Scope Types:

  • project

Add a secret to an existing container.

container_secret:delete
Default:

True:%(enforce_new_defaults)s and (rule:container_project_admin or (rule:container_project_member and rule:container_owner) or (rule:container_project_member and  rule:container_is_not_private))

Operations:

  • DELETE /v1/containers/{container-id}/secrets/{secret-id}

Scope Types:

  • project

Remove a secret from a container.

orders:get
Default:

True:%(enforce_new_defaults)s and role:member

Operations:

  • GET /v1/orders

Scope Types:

  • project

List all orders associated with a project.

orders:post
Default:

True:%(enforce_new_defaults)s and role:member

Operations:

  • POST /v1/orders

Scope Types:

  • project

Create an order.

orders:put
Default:

True:%(enforce_new_defaults)s and role:member

Operations:

  • PUT /v1/orders

Scope Types:

  • project

Unsupported method for the orders API.

order:get
Default:

True:%(enforce_new_defaults)s and rule:order_project_member

Operations:

  • GET /v1/orders/{order-id}

Scope Types:

  • project

Retrieve an order’s metadata.

order:delete
Default:

True:%(enforce_new_defaults)s and rule:order_project_member

Operations:

  • DELETE /v1/orders/{order-id}

Scope Types:

  • project

Delete an order.

quotas:get
Default:

True:%(enforce_new_defaults)s and role:reader

Operations:

  • GET /v1/quotas

Scope Types:

  • project

List quotas for the project the user belongs to.

project_quotas:get
Default:

True:%(enforce_new_defaults)s and role:admin

Operations:

  • GET /v1/project-quotas

  • GET /v1/project-quotas/{uuid}

Scope Types:

  • project

List quotas for the specified project.

project_quotas:put
Default:

True:%(enforce_new_defaults)s and role:admin

Operations:

  • PUT /v1/project-quotas/{uuid}

Scope Types:

  • project

Create or update the configured project quotas for the project with the specified UUID.

project_quotas:delete
Default:

True:%(enforce_new_defaults)s and role:admin

Operations:

  • DELETE /v1/project-quotas/{uuid}

Scope Types:

  • project

Delete the project quotas configuration for the project with the specified UUID.

secret_meta:get
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private) or rule:secret_acl_read)

Operations:

  • GET /v1/secrets/{secret-id}/metadata

  • GET /v1/secrets/{secret-id}/metadata/{meta-key}

Scope Types:

  • project

List a secret’s user-defined metadata, or retrieve a single item from a secret’s user-defined metadata by key.

secret_meta:post
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))

Operations:

  • POST /v1/secrets/{secret-id}/metadata

Scope Types:

  • project

Add a new key/value pair to the secret’s user-defined metadata.

secret_meta:put
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))

Operations:

  • PUT /v1/secrets/{secret-id}/metadata

  • PUT /v1/secrets/{secret-id}/metadata/{meta-key}

Scope Types:

  • project

Set a secret’s user-defined metadata, or update a single item in a secret’s user-defined metadata by key.

secret_meta:delete
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))

Operations:

  • DELETE /v1/secrets/{secret-id}/metadata/{meta-key}

Scope Types:

  • project

Delete a secret’s user-defined metadata by key.

secret:decrypt
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private) or rule:secret_acl_read)

Operations:

  • GET /v1/secrets/{secret-id}/payload

Scope Types:

  • project

Retrieve a secret’s payload.

secret:get
Default:

True:%(enforce_new_defaults)s and (role:admin or rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private) or rule:secret_acl_read)

Operations:

  • GET /v1/secrets/{secret-id}

Scope Types:

  • project

Retrieve a secret’s metadata.

secret:put
Default:

True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))

Operations:

  • PUT /v1/secrets/{secret-id}

Scope Types:

  • project

Add the payload to an existing metadata-only secret.

secret:delete
Default:

True:%(enforce_new_defaults)s and (role:admin or rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))

Operations:

  • DELETE /v1/secrets/{secret-id}

Scope Types:

  • project

Delete a secret.

secrets:post
Default:

True:%(enforce_new_defaults)s and role:member

Operations:

  • POST /v1/secrets

Scope Types:

  • project

Create a secret.

secrets:get
Default:

True:%(enforce_new_defaults)s and role:member

Operations:

  • GET /v1/secrets

Scope Types:

  • project

List a project’s secrets.

secret:migrate_secretstore
Default:

True:%(enforce_new_defaults)s and (role:admin or (rule:secret_project_member and secret_store_id:%(target.secret.preferred_secret_store_id)s))

Operations:

  • PUT /v1/secrets/{secret-id}/secret-store/{secret-store-id}

Scope Types:

  • project

  • domain

  • system

Migrate a secret to a named secret store. Admins may target any store; members may migrate only to the project preferred store (or the global default).

secretstores:get
Default:

True:%(enforce_new_defaults)s and role:reader

Operations:

  • GET /v1/secret-stores

Scope Types:

  • project

Get a list of available secret store backends.

secretstores:get_global_default
Default:

True:%(enforce_new_defaults)s and role:reader

Operations:

  • GET /v1/secret-stores/global-default

Scope Types:

  • project

Get a reference to the secret store used as the default secret store backend for the deployment.

secretstores:get_preferred
Default:

True:%(enforce_new_defaults)s and role:reader

Operations:

  • GET /v1/secret-stores/preferred

Scope Types:

  • project

Get a reference to the preferred secret store, if one has been assigned previously.

secretstore_preferred:post
Default:

True:%(enforce_new_defaults)s and role:admin

Operations:

  • POST /v1/secret-stores/{secret-store-id}/preferred

Scope Types:

  • project

Set a secret store backend as the preferred backend for the project.

secretstore_preferred:delete
Default:

True:%(enforce_new_defaults)s and role:admin

Operations:

  • DELETE /v1/secret-stores/{secret-store-id}/preferred

Scope Types:

  • project

Remove the preferred secret store backend setting for the project.

secretstore:get
Default:

True:%(enforce_new_defaults)s and role:reader

Operations:

  • GET /v1/secret-stores/{secret-store-id}

Scope Types:

  • project

Get the details of a secret store by its ID.

transport_key:get
Default:

True:%(enforce_new_defaults)s and role:reader

Operations:

  • GET /v1/transport_keys/{transport-key-id}

Scope Types:

  • project

Get a specific transport key.

transport_key:delete
Default:

True:%(enforce_new_defaults)s and role:admin

Operations:

  • DELETE /v1/transport_keys/{transport-key-id}

Scope Types:

  • project

Delete a specific transport key.

transport_keys:get
Default:

True:%(enforce_new_defaults)s and role:reader

Operations:

  • GET /v1/transport_keys

Scope Types:

  • project

Get a list of all transport keys.

transport_keys:post
Default:

True:%(enforce_new_defaults)s and role:admin

Operations:

  • POST /v1/transport_keys

Scope Types:

  • project

Create a new transport key.