diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_endpoint_filter_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_endpoint_filter_rbac.py
new file mode 100644
index 0000000..2892b17
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_endpoint_filter_rbac.py
@@ -0,0 +1,91 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest.lib.common.utils import test_utils
+from tempest.lib import decorators
+
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.tests.api.identity.v3 import rbac_base
+
+
+class IdentityEndpointsFilterV3RbacTest(
+        rbac_base.BaseIdentityV3RbacTest):
+
+    @classmethod
+    def setup_clients(cls):
+        super(IdentityEndpointsFilterV3RbacTest, cls).setup_clients()
+        cls.ep_api_client = cls.os.endpoint_filter_client
+
+    @classmethod
+    def resource_setup(cls):
+        super(IdentityEndpointsFilterV3RbacTest, cls).resource_setup()
+        cls.project = cls.setup_test_project()
+        cls.service = cls.setup_test_service()
+        cls.endpoint = cls.setup_test_endpoint(service=cls.service)
+
+    def _add_endpoint_to_project(self):
+        # Adding and cleaning up endpoints to projects
+        self.ep_api_client.add_endpoint_to_project(
+            self.project['id'], self.endpoint['id'])
+        self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+                        self.ep_api_client.delete_endpoint_from_project,
+                        self.project['id'], self.endpoint['id'])
+
+    @rbac_rule_validation.action(
+        service="keystone",
+        rule="identity:add_endpoint_to_project")
+    @decorators.idempotent_id('9199ec13-816d-4efe-b8b1-e1cd026b9747')
+    def test_add_endpoint_to_project(self):
+        # Adding endpoints to projects
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self._add_endpoint_to_project()
+
+    @rbac_rule_validation.action(
+        service="keystone",
+        rule="identity:list_projects_for_endpoint")
+    @decorators.idempotent_id('f53dca42-ec8a-48e9-924b-0bbe6c99727f')
+    def test_list_projects_for_endpoint(self):
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.ep_api_client.list_projects_for_endpoint(
+            self.endpoint['id'])
+
+    @rbac_rule_validation.action(
+        service="keystone",
+        rule="identity:check_endpoint_in_project")
+    @decorators.idempotent_id('0c1425eb-833c-4aa1-a21d-52ffa41fdc6a')
+    def test_check_endpoint_in_project(self):
+        self._add_endpoint_to_project()
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.ep_api_client.check_endpoint_in_project(
+            self.project['id'], self.endpoint['id'])
+
+    @rbac_rule_validation.action(
+        service="keystone",
+        rule="identity:list_endpoints_for_project")
+    @decorators.idempotent_id('5d86c659-c6ad-41e0-854e-3823e95c7cc2')
+    def test_list_endpoints_in_project(self):
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.ep_api_client.list_endpoints_in_project(
+            self.project['id'])
+
+    @rbac_rule_validation.action(
+        service="keystone",
+        rule="identity:remove_endpoint_from_project")
+    @decorators.idempotent_id('b4e21c10-4f47-427b-9b8a-f5b5601adfda')
+    def test_remove_endpoint_from_project(self):
+        self._add_endpoint_to_project()
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.ep_api_client.delete_endpoint_from_project(
+            self.project['id'], self.endpoint['id'])
diff --git a/patrole_tempest_plugin/tests/api/image/v2/test_images_rbac.py b/patrole_tempest_plugin/tests/api/image/v2/test_images_rbac.py
index fa492bb..e7fe87f 100644
--- a/patrole_tempest_plugin/tests/api/image/v2/test_images_rbac.py
+++ b/patrole_tempest_plugin/tests/api/image/v2/test_images_rbac.py
@@ -29,6 +29,18 @@
         super(BasicOperationsImagesRbacTest, cls).setup_clients()
         cls.client = cls.os.image_client_v2
 
+    def _create_image(self, **kwargs):
+        image_name = data_utils.rand_name('image')
+        image = self.create_image(name=image_name,
+                                  container_format='bare',
+                                  disk_format='raw',
+                                  **kwargs)
+        return image
+
+    def _upload_image(self, image_id):
+        image_file = moves.cStringIO(data_utils.random_bytes())
+        return self.client.store_image_file(image_id, image_file)
+
     @rbac_rule_validation.action(service="glance",
                                  rule="add_image")
     @decorators.idempotent_id('0f148510-63bf-11e6-b348-080027d0d606')
@@ -38,14 +50,8 @@
 
         RBAC test for the glance create_image endpoint
         """
-        uuid = '00000000-1111-2222-3333-444455556666'
-        image_name = data_utils.rand_name('image')
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_image(name=image_name,
-                          container_format='bare',
-                          disk_format='raw',
-                          visibility='private',
-                          ramdisk_id=uuid)
+        self._create_image()
 
     @rbac_rule_validation.action(service="glance",
                                  rule="upload_image")
@@ -56,18 +62,25 @@
 
         RBAC test for the glance upload_image endpoint
         """
-        uuid = '00000000-1111-2222-3333-444455556666'
-        image_name = data_utils.rand_name('image')
-        body = self.create_image(name=image_name,
-                                 container_format='bare',
-                                 disk_format='raw',
-                                 visibility='private',
-                                 ramdisk_id=uuid)
+        image = self._create_image()
 
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        # Try uploading an image file
-        image_file = moves.cStringIO(data_utils.random_bytes())
-        self.client.store_image_file(body['id'], image_file)
+        self._upload_image(image['id'])
+
+    @decorators.idempotent_id('f0c268f3-cb51-49aa-9bd5-d30cf647322f')
+    @rbac_rule_validation.action(service="glance",
+                                 rule="download_image")
+    def test_download_image(self):
+
+        """Download Image Test
+
+        RBAC test for the glance download_image endpoint
+        """
+        image = self._create_image()
+        self._upload_image(image['id'])
+
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.client.show_image_file(image['id'])
 
     @rbac_rule_validation.action(service="glance",
                                  rule="delete_image")
@@ -78,16 +91,11 @@
 
         RBAC test for the glance delete_image endpoint
         """
-        image_name = data_utils.rand_name('image')
-        body = self.create_image(name=image_name,
-                                 container_format='bare',
-                                 disk_format='raw',
-                                 visibility='public')
-        image_id = body.get('id')
-        # Toggle role and delete created image
+        image = self._create_image()
+
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.client.delete_image(image_id)
-        self.client.wait_for_resource_deletion(image_id)
+        self.client.delete_image(image['id'])
+        self.client.wait_for_resource_deletion(image['id'])
 
     @rbac_rule_validation.action(service="glance",
                                  rule="get_image")
@@ -98,16 +106,10 @@
 
         RBAC test for the glance create_image endpoint
         """
+        image = self._create_image()
 
-        image_name = data_utils.rand_name('image')
-        body = self.create_image(name=image_name,
-                                 container_format='bare',
-                                 disk_format='raw',
-                                 visibility='private')
-        image_id = body.get('id')
-        # Toggle role and get created image
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.client.show_image(image_id)
+        self.client.show_image(image['id'])
 
     @rbac_rule_validation.action(service="glance",
                                  rule="get_images")
@@ -118,10 +120,8 @@
 
         RBAC test for the glance list_images endpoint
         """
-
-        # Toggle role and get created image
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.client.list_images()
+        self.client.list_images()['images']
 
     @rbac_rule_validation.action(service="glance",
                                  rule="modify_image")
@@ -132,22 +132,42 @@
 
         RBAC test for the glance update_image endpoint
         """
-        image_name = data_utils.rand_name('image')
-        body = self.create_image(name=image_name,
-                                 container_format='bare',
-                                 disk_format='raw',
-                                 visibility='private')
-        image_id = body.get('id')
+        image = self._create_image()
 
-        # Now try uploading an image file
-        image_file = moves.cStringIO(data_utils.random_bytes())
-        self.client.store_image_file(image_id, image_file)
-
-        # Toggle role and update created image
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        new_image_name = data_utils.rand_name('new-image')
-        body = self.client.update_image(image_id, [
-            dict(replace='/name', value=new_image_name)])
+        updated_image_name = data_utils.rand_name('image')
+        self.client.update_image(image['id'], [
+            dict(replace='/name', value=updated_image_name)])
+
+    @decorators.idempotent_id('244050d9-1b9a-446a-b3c5-f26f3ba8eb75')
+    @rbac_rule_validation.action(service="glance",
+                                 rule="modify_image")
+    def test_create_image_tag(self):
+
+        """Create image tag
+
+        RBAC test for the glance add_image_tag endpoint
+        """
+        image = self._create_image()
+
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.client.add_image_tag(image['id'], data_utils.rand_name('tag'))
+
+    @decorators.idempotent_id('c4a0bf9c-b78b-48c6-a31f-72c95f943c6e')
+    @rbac_rule_validation.action(service="glance",
+                                 rule="modify_image")
+    def test_delete_image_tag(self):
+
+        """Delete image tag
+
+        RBAC test for the glance delete_image_tag endpoint
+        """
+        image = self._create_image()
+        tag_name = data_utils.rand_name('tag')
+        self.client.add_image_tag(image['id'], tag_name)
+
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.client.delete_image_tag(image['id'], tag_name)
 
     @rbac_rule_validation.action(service="glance",
                                  rule="publicize_image")
@@ -158,12 +178,8 @@
 
         RBAC test for the glance publicize_image endpoint
         """
-        image_name = data_utils.rand_name('image')
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.create_image(name=image_name,
-                          container_format='bare',
-                          disk_format='raw',
-                          visibility='public')
+        self._create_image(visibility='public')
 
     @rbac_rule_validation.action(service="glance",
                                  rule="deactivate")
@@ -174,20 +190,11 @@
 
         RBAC test for the glance deactivate_image endpoint
         """
-        uuid = '00000000-1111-2222-3333-444455556666'
-        image_name = data_utils.rand_name('image')
-        body = self.create_image(name=image_name,
-                                 container_format='bare',
-                                 disk_format='raw',
-                                 visibility='private',
-                                 ramdisk_id=uuid)
-        image_id = body.get('id')
-        # Now try uploading an image file
-        image_file = moves.cStringIO(data_utils.random_bytes())
-        self.client.store_image_file(image_id=image_id, data=image_file)
-        # Toggling role and deacivate image
+        image = self._create_image()
+        self._upload_image(image['id'])
+
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.client.deactivate_image(image_id)
+        self.client.deactivate_image(image['id'])
 
     @rbac_rule_validation.action(service="glance",
                                  rule="reactivate")
@@ -198,18 +205,8 @@
 
         RBAC test for the glance reactivate_image endpoint
         """
-        uuid = '00000000-1111-2222-3333-444455556666'
-        image_name = data_utils.rand_name('image')
-        body = self.create_image(name=image_name,
-                                 container_format='bare',
-                                 disk_format='raw',
-                                 visibility='private',
-                                 ramdisk_id=uuid)
+        image = self._create_image()
+        self._upload_image(image['id'])
 
-        # Now try uploading an image file
-        image_id = body.get('id')
-        image_file = moves.cStringIO(data_utils.random_bytes())
-        self.client.store_image_file(image_id=image_id, data=image_file)
-        # Toggling role and reactivate image
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        self.client.reactivate_image(image_id)
+        self.client.reactivate_image(image['id'])
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py
index 70c73fc..d6c2d13 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volume_actions_rbac.py
@@ -13,8 +13,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import testtools
-
 from tempest.common import compute
 from tempest.common import waiters
 from tempest import config
@@ -31,10 +29,18 @@
 
 class VolumesActionsRbacTest(rbac_base.BaseVolumeRbacTest):
 
+    # TODO(felipemonteiro): "volume_extension:volume_actions:upload_public"
+    # test can be created once volumes v3 client is created in Tempest.
+
     @classmethod
     def setup_clients(cls):
         super(VolumesActionsRbacTest, cls).setup_clients()
-        cls.client = cls.os.volumes_client
+        cls.client = cls.volumes_client
+        if CONF.image_feature_enabled.api_v1:
+            cls.image_client = cls.os.image_client
+        elif CONF.image_feature_enabled.api_v2:
+            cls.image_client = cls.os.image_client_v2
+        cls.image_id = CONF.compute.image_ref
 
     @classmethod
     def resource_setup(cls):
@@ -42,10 +48,10 @@
         cls.volume = cls.create_volume()
 
     def _create_server(self):
-        body, _ = compute.create_test_server(self.os, wait_until='ACTIVE')
+        server, _ = compute.create_test_server(self.os, wait_until='ACTIVE')
         self.addCleanup(test_utils.call_and_ignore_notfound_exc,
-                        self.servers_client.delete_server, body['id'])
-        return body
+                        self.servers_client.delete_server, server['id'])
+        return server
 
     def _attach_volume(self, server):
         self.servers_client.attach_volume(
@@ -60,52 +66,89 @@
         waiters.wait_for_volume_resource_status(
             self.client, self.volume['id'], 'available')
 
-    @testtools.skipUnless(CONF.service_available.nova,
-                          "Nova is required to create a server")
+    @test.services('compute')
     @rbac_rule_validation.action(service="cinder", rule="volume:attach")
     @decorators.idempotent_id('f97b10e4-2eed-4f8b-8632-71c02cb9fe42')
     def test_attach_volume_to_instance(self):
         server = self._create_server()
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        # Attach the volume
         self._attach_volume(server)
 
-    @test.attr(type="slow")
+    @test.attr(type=["slow"])
+    @test.services('compute')
     @rbac_rule_validation.action(service="cinder", rule="volume:detach")
     @decorators.idempotent_id('5a042f6a-688b-42e6-a02e-fe5c47b89b07')
     def test_detach_volume_from_instance(self):
-        # Attach the volume
         server = self._create_server()
         self._attach_volume(server)
+
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        # Detach the volume
         self._detach_volume()
 
-    @testtools.skipIf(True, "Patrole bug #1672799")
-    @rbac_rule_validation.action(service="cinder",
-                                 rule="volume:copy_volume_to_image")
+    @test.services('image')
+    @rbac_rule_validation.action(
+        service="cinder",
+        rule="volume_extension:volume_actions:upload_image")
     @decorators.idempotent_id('b0d0da46-903c-4445-893e-20e680d68b50')
     def test_volume_upload(self):
-        self.image_client = self.os.image_client
-        image_name = data_utils.rand_name('image')
+        # TODO(felipemonteiro): The ``upload_volume`` endpoint also enforces
+        # "volume:copy_volume_to_image" but is not currently contained in
+        # Cinder's policy.json.
+        image_name = data_utils.rand_name(self.__class__.__name__ + '-Image')
+
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
         body = self.client.upload_volume(
-            self.volume['id'], image_name=image_name,
+            self.volume['id'], image_name=image_name, visibility="private",
             disk_format=CONF.volume.disk_format)['os-volume_upload_image']
+        image_id = body["image_id"]
         self.addCleanup(test_utils.call_and_ignore_notfound_exc,
                         self.image_client.delete_image,
-                        body['image_id'])
-        waiters.wait_for_volume_resource_status(
-            self.client, self.volume['id'], 'available')
+                        image_id)
+        waiters.wait_for_image_status(self.image_client, image_id, 'active')
+        waiters.wait_for_volume_resource_status(self.os_adm.volumes_client,
+                                                self.volume['id'], 'available')
 
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume:update_readonly_flag")
     @decorators.idempotent_id('2750717a-f250-4e41-9e09-02624aad6ff8')
     def test_volume_readonly_update(self):
-        volume = self.create_volume()
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
-        # Update volume readonly
-        self.client.update_volume_readonly(volume['id'], readonly=True)
+
+        self.client.update_volume_readonly(self.volume['id'], readonly=True)
+        self.addCleanup(self.client.update_volume_readonly,
+                        self.volume['id'], readonly=False)
+
+    @decorators.idempotent_id('a9d9e825-5ea3-42e6-96f3-7ac4e97b2ed0')
+    @rbac_rule_validation.action(
+        service="cinder",
+        rule="volume:update_volume_metadata")
+    def test_update_volume_image_metadata(self):
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+
+        self.volumes_client.update_volume_image_metadata(
+            self.volume['id'], image_id=self.image_id)
+
+    @decorators.idempotent_id('a41c8eed-2051-4a25-b401-df036faacbdc')
+    @rbac_rule_validation.action(
+        service="cinder",
+        rule="volume:delete_volume_metadata")
+    def test_delete_volume_image_metadata(self):
+        self.volumes_client.update_volume_image_metadata(
+            self.volume['id'], image_id=self.image_id)
+
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.volumes_client.delete_volume_image_metadata(
+            self.volume['id'], 'image_id')
+
+    @decorators.idempotent_id('72bab13c-dfaf-4b6d-a132-c83a85fb1776')
+    @rbac_rule_validation.action(
+        service="cinder",
+        rule="volume_extension:volume_unmanage")
+    def test_unmanage_volume(self):
+        volume = self.create_volume()
+
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.volumes_client.unmanage_volume(volume['id'])
 
 
 class VolumesActionsV3RbacTest(VolumesActionsRbacTest):
diff --git a/releasenotes/notes/endpoint-filter-projects-7f64c88659ef0c30.yaml b/releasenotes/notes/endpoint-filter-projects-7f64c88659ef0c30.yaml
new file mode 100644
index 0000000..1537618
--- /dev/null
+++ b/releasenotes/notes/endpoint-filter-projects-7f64c88659ef0c30.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    Adds RBAC tests for the project-related endpoints belonging to the
+    OS-EP-FILTER Keystone v3 extension API.