diff --git a/metadata/service/file_permissions.yml b/metadata/service/file_permissions.yml
new file mode 100644
index 0000000..e2733c9
--- /dev/null
+++ b/metadata/service/file_permissions.yml
@@ -0,0 +1,14 @@
+parameters:
+  keystone:
+    directories:
+      /etc/keystone:
+        mode: '0750'
+        user: 'keystone'
+    files:
+      /etc/keystone/keystone-paste.ini:
+        user: 'keystone'
+      /etc/keystone/logging.conf:
+        user: 'keystone'
+      /etc/keystone/policy.json:
+        user: 'keystone'
+