diff --git a/tests/pillar/server_cluster.sls b/tests/pillar/server_cluster.sls
index 0a8e0f5..c0330aa 100644
--- a/tests/pillar/server_cluster.sls
+++ b/tests/pillar/server_cluster.sls
@@ -51,3 +51,7 @@
       user: openstack
       password: password
       virtual_host: '/openstack'
+    policy:
+      deny_stack_user: 'not role:heat_stack_user'
+      'cloudformation:ValidateTemplate': 'rule:deny_stack_user'
+      'cloudformation:DescribeStackResource':