...
- Root Admin Policy: have permissions to all resources in the CloudStack.
- Domain Admin Policy: have permissions to all resources under the belonging domain.
- Resource Owner Policy: have permissions to all owned resources.
Other than that, customer should be able to define customized policies by grant or deny permission to customize permissions for the group. So far, for cross-account permission grant, we are currently supporting the following 3 types of granting/denying:
- Grant by Domain and Resource Type: grant permissions to all resources of the given resource type under the given domain.
- Grant by Account and Resource Type: grant permissions to all resources of the given resource type under the given account.
- Grant by individual resource: grant permission to an individual resource.