Clean up "target" interface to policy

The docstring is wrong for this argument, and we pass an empty
dict since we're not using this data for policy decisions at
the moment, so default it inside common.policy.Enforcer.

Change-Id: I298e691e12ed10825327492f02bd2f4edec24323
test_common_policy cleanups

Make test_common_policy.py a bit less repetitive, and ensure
VerifyAll is used consistently via cleanup

Change-Id: Ic7f017661d034c1968a6888c03c7492db9c47b3f
Sync openstack.common.local from oslo

`local` has a broken TLS symbol - strong_store, fixed in oslo some time
ago in
Ib544be1485823f6c619312fdee5a04031f48bbb4. All direct and indirect
(lockutils and rpc) usages of strong_store might be potentially
affected.
Original change to Nova: If4dd973acc23921dbc2bc69bb76225deb2802dad

Change-Id: I6839c80c6153b2f4fd28579c33a1a029b8276702
Closes-Bug: #1254046
Implement PrivateIpAddress attribute

The PrivateIpAddress attribute maps to the private IP address of the
AWS::EC2::NetworkInterface resource.

Change-Id: I471e9ab9ea6fed8bc09a6339d11bcf1f1e4528f8
Closes-Bug: #1254675
Remove external AWS links and add doc if needed.

Closes bug #1252640

Change-Id: Ifae43c7ba457e8962360dd5b70cbb8b202365eee
Merge "Clean up "target" interface to policy"
Merge "test_common_policy cleanups"
Let resources decide when to update

Previously, the StackUpdate code decided when an update was necessary for a
resource. However, all of the information required to make this decision is
available to the resource, so push this decision into the resource so that
it can implement custom behaviour if necessary.

Change-Id: If098424cf2502c02bad4194d509393d198d8745f
Merge "Implement PrivateIpAddress attribute"
Avoid eventlet-unsafe exception handling

Eventlet can context-switch during a log call (at least in principle).
Therefore it is unsafe to use "raise" after this call, because the exception
raised may not be the same one caught by the "except" block, but rather
could be any random exception from some other greenlet.

This is a canonical example of why eventlet is pure evil.

Fixes bug: #1255506

Change-Id: Ieb0eb763c0fd696b82212653ac4909d2bddf6b88
Fix not correct AWS::StackId value

Add call of method _set_param_stackid() to method update_task() in class
parser.Stack. This ensures that an updated stack still has the right
AWS::StackId param.
Add a unit test for this case.

Change-Id: I0d28346631546577a85735292a24c2512476d4b4
Closes-Bug: #1240888
Catch error deleting trust on stack delete

When deleting a stack, it's possible for deleting the trust to fail,
for example if the user deleting the stack is not the user who created
it, or an admin (which raises a Forbidden error), or due to some
other transient error e.g connection to keystone interrupted.

Currently in this case, we fail to mark the stack deleted in the DB
and leave the status "DELETE, COMPLETE", which is misleading.

Change-Id: Ie8e9ea48bc4f44e56ff4764123fcca733f5bd458
Partial-Bug: #1247200
Ensure that members is a list

self.properties.get('members') should not be None.  Ensure that
an empty list is returned instead.

Change-Id: I01d191eafebac30ad25505b312ff6e936181bdbf
Closes-Bug: #1255697
Add check_is_admin to common.policy.Enforcer

Currently we have no concept of admin-ness inside Heat, so it's
not possible for deployers to specify a hierarchy within a project
such that some users have more privileged access than others.

The first step is to provide a means to specify in the policy a
rule which describes who is admin, then we can correctly set
is_admin in the context based on that rule.

blueprint: request-scoping-policy

Change-Id: Idd1fb5f4e52bda87c70830d66e0c931bfe879347
Merge "Fix not correct AWS::StackId value"
Merge "Sync openstack.common.local from oslo"
Merge "Let resources decide when to update"
Imported Translations from Transifex

Change-Id: Iae4d296728f802cc217d36f12f296cbaa75055c7
Merge "Ensure that members is a list"
Merge "Imported Translations from Transifex"