diff --git a/keystone/upgrade/pre/init.sls b/keystone/upgrade/pre/init.sls
index 34438ac..8c7bfef 100644
--- a/keystone/upgrade/pre/init.sls
+++ b/keystone/upgrade/pre/init.sls
@@ -6,6 +6,13 @@
 
 {%- if server.enabled %}
 
+{#- NOTE(oshyshko): we've run `keystone-manage doctor` run as under keystone user and we need to correct permissions for keystone-manage.log #}
+/var/log/keystone/keystone-manage.log:
+  file.managed:
+  - user: keystone
+  - group: keystone
+  - onlyif: test -f /var/log/keystone/keystone-manage.log
+
 keystone_doctor:
   cmd.run:
     - name: keystone-manage doctor