"credential_owner": "rule:owner and user_id:%(target.user_id)s",
    "identity:ec2_delete_credential": "rule:admin or rule:credential_owner",