Secret Access Control (ACL)

Overview

By default, secrets and containers are private to the project that created them. ACLs grant specific users read access to secrets and containers across project boundaries, enabling secure credential sharing without exposing the payload itself.

Prerequisites

An active Polystack account with appropriate permissions
Access to the Polystack Dashboard or CLI configured with credentials
API credentials sourced (source openrc.sh)

ACL Concepts

Concept	Description
read	Allows the grantee to retrieve the secret payload or container contents
per-user ACL	Grants access to specific user IDs — most restrictive and recommended for sensitive secrets
project-access	Grants all users in the secret’s own project read access — use only for non-sensitive shared config

View Current ACL

Show ACL on a secret

openstack acl get <secret-href>

Show ACL on a container

openstack acl get <container-href>

Grant Access

Dashboard
CLI

Navigate to Key Manager > Secrets, select a secret, and click the Access Control tab. Click Add ACL to grant access to a specific user.

Field	Description
Operation	`read` — allows the user to retrieve the secret payload
Users	Polystack user IDs to grant the permission
Project Access	Toggle to grant all users in the secret’s project read access

Grant read access to a specific user

openstack acl submit \
  --user <user-id> \
  --operation read \
  <secret-href>

Grant project-wide read access

openstack acl submit \
  --project-access \
  <secret-href>

Grant access to multiple users

openstack acl submit \
  --user <user-id-1> \
  --user <user-id-2> \
  --operation read \
  <secret-href>

Granting --project-access makes the secret readable by all users in the project. Reserve this setting for non-sensitive shared configuration. Use per-user ACLs for credentials, private keys, and certificates.

Revoke Access

Revoke all ACL entries on a secret

openstack acl delete <secret-href>

Update ACL to remove a specific user

openstack acl submit \
  --user <remaining-user-id> \
  --operation read \
  <secret-href>

openstack acl submit replaces the entire ACL. To remove one user, resubmit the ACL with only the users that should retain access. There is no append/remove operation.

Find Your User ID

Get the current user's ID

openstack token issue -c user_id -f value

Look up another user's ID (admin)

openstack user show <username> -c id -f value

Next Steps

Store Secrets

Create secrets before configuring ACL access

Containers

Apply ACLs at the container level for grouped secret access

Troubleshooting

Resolve 403 errors and ACL propagation issues

Key Manager Admin Guide

Configure platform-wide access policies and quotas

Core Services

Other Services

Overview

ACL Concepts

View Current ACL

Grant Access

Revoke Access

Find Your User ID

Next Steps

Store Secrets

Containers

Troubleshooting

Key Manager Admin Guide

​Overview

​ACL Concepts

​View Current ACL

​Grant Access

​Revoke Access

​Find Your User ID

​Next Steps

Store Secrets

Containers

Troubleshooting

Key Manager Admin Guide

Overview

ACL Concepts

View Current ACL

Grant Access

Revoke Access

Find Your User ID

Next Steps