actions_most_restricted:
  scope: "actions"
  actions:
    - "snapshot"
    - "suspend"
    - "resume"
    - "cancel_update"
    - "cancel_without_rollback"
  allowed:
    - "project_member"
  denied:
    - "project_reader"
    - "stack_user"
    - "system_admin"

actions_restricted:
  scope: "actions"
  actions:
    - "check"
  allowed:
    - "project_reader"
  denied:
    - "stack_user"
    - "system_admin"

cloud_formation_most_restricted:
  scope: "cloudformation"
  actions:
    - "CreateStack"
    - "DeleteStack"
    - "UpdateStack"
  allowed:
    - "project_member"
  denied:
    - "project_reader"
    - "stack_user"
    - "system_admin"

cloud_formation_restricted:
  scope: "cloudformation"
  actions:
    - "ListStacks"
    - "DescribeStacks"
    - "DescribeStackEvents"
    - "GetTemplate"
    - "EstimateTemplateCost"
    - "DescribeStackResources"
    - "ValidateTemplate"
  allowed:
    - "project_reader"
  denied:
    - "stack_user"
    - "system_admin"

cloud_formation_least_restricted:
  scope: "cloudformation"
  actions:
    - "DescribeStackResource"
  allowed:
    - "project_reader"
    - "stack_user"
  denied:
    - "system_admin"

build_info_acl:
  scope: "build_info"
  actions:
    - "build_info"
  allowed:
    - "project_reader"
  denied:
    - "stack_user"
    - "system_admin"

events_acl:
  scope: "events"
  actions:
    - "index"
    - "show"
  allowed:
    - "project_reader"
  denied:
    - "stack_user"
    - "system_admin"

resource_least_restricted:
  scope: "resource"
  actions:
    - "metadata"
    - "signal"
  allowed:
    - "stack_user"
    - "project_reader"
  denied:
    - "system_admin"

resource_restricted:
  scope: "resource"
  actions:
    - "index"
    - "show"
  allowed:
    - "project_reader"
  denied:
    - "stack_user"
    - "system_admin"

resource_most_restricted:
  scope: "resource"
  actions:
    - "mark_unhealthy"
  allowed:
    - "project_member"
  denied:
    - "project_reader"
    - "stack_user"
    - "system_admin"

service_acl:
  scope: "service"
  actions:
    - "index"
  allowed:
    - "project_admin"
  denied:
    - "system_admin"
    - "project_member"
    - "stack_user"

software_configs_restricted_index:
  scope: "software_configs"
  actions:
    - "global_index"
  denied:
    - "system_admin"
    - "project_admin"

software_configs_most_restricted:
  scope: "software_configs"
  actions:
    - "create"
    - "delete"
  allowed:
    - "project_member"
  denied:
    - "stack_user"

software_configs_restricted:
  scope: "software_configs"
  actions:
    - "index"
    - "show"
  allowed:
    - "project_reader"
  denied:
    - "stack_user"

software_deployments_most_restricted:
  scope: "software_deployments"
  actions:
    - "create"
    - "update"
    - "delete"
  allowed:
    - "project_member"
  denied:
    - "stack_user"

software_deployments_restricted:
  scope: "software_deployments"
  actions:
    - "index"
    - "show"
  allowed:
    - "project_reader"
  denied:
    - "stack_user"
    - "system_admin"

software_deployments_least_restricted:
  scope: "software_deployments"
  actions:
    - "metadata"
  allowed:
    - "project_reader"
    - "stack_user"
  denied:
    - "system_admin"

stacks_most_restricted:
  scope: "stacks"
  actions:
    - "abandon"
    - "create"
    - "delete"
    - "export"
    - "generate_template"
    - "update"
    - "update_patch"
    - "preview_update"
    - "preview_update_patch"
    - "validate_template"
    - "snapshot"
    - "delete_snapshot"
    - "restore_snapshot"
  allowed:
    - "project_member"
  denied:
    - "project_reader"
    - "stack_user"
    - "system_admin"

stacks_restricted:
  scope: "stacks"
  actions:
    - "detail"
    - "index"
    - "list_resource_types"
    - "list_template_versions"
    - "list_template_functions"
    - "preview"
    - "resource_schema"
    - "show"
    - "template"
    - "environment"
    - "files"
    - "show_snapshot"
    - "list_snapshots"
    - "list_outputs"
    - "show_output"
  allowed:
    - "project_reader"
  denied:
    - "stack_user"
    - "system_admin"

stacks_restricted_index:
  scope: "stacks"
  actions:
    - "global_index"
  denied:
    - "system_admin"
    - "project_admin"

stacks_open:
  scope: "stacks"
  actions:
    - "lookup"
  allowed:
    - "project_reader"
    - "stack_user"
  denied:
    - "system_admin"

create_stacks:
  scope: "stacks"
  actions:
    - "create"
  allowed:
    - "project_member"
  denied:
    - "project_reader"
    - "system_admin"
