Background

Currently CloudStack provides very limited IAM services and there are several drawbacks within those services:

...

Regular user 'domainUserA' calls this command for his own VM:

API access check

The APIlayer API layer will call the APICheckers to see if the user is allowed to invoke this API. The PolicyBasedAccessChecker :: checkAccess(user, apiName) will just return true and rely on next step

...