...
- Root Admin Policy: have permissions to all resources in the CloudStack for allowed APIs.
- Domain Admin Policy: have permissions to all resources under the belonging domain for allowed APIs.
- Resource Owner Policy: have permissions to all owned resources for allowed APIs.
Other than that, customer should be able to define customized policies by grant or deny permission to customize permissions for the group. So far, for cross-account permission grant, we are currently supporting the following 3 types of granting/denying:
...