metadata/service/file_permissions.yml

parameters:
  keystone:
    directories:
      /etc/keystone:
        mode: '0750'
        user: 'keystone'
    files:
      /etc/keystone/keystone-paste.ini:
        user: 'keystone'
      /etc/keystone/logging.conf:
        user: 'keystone'
      /etc/keystone/policy.json:
        user: 'keystone'