7.9. Protecting the Overcloud from Removal

To avoid accidental removal of the Overcloud with the heat stack-delete overcloud command, Heat contains a set of policies to restrict certain actions. Edit the /etc/heat/policy.json and find the following parameter:
"stacks:delete": "rule:deny_stack_user"
Change it to:
"stacks:delete": "rule:deny_everybody"
Save the file.
This prevents removal of the Overcloud with the heat client. The allow removal of the Overcloud, revert the policy to the original value.