Ceilometer needs a role that allows the retrieval of metrics. That includes the capacity to iterate over the projects inspecting the objects created in each one of them (number and size). Currently this is being done using the ResellerAdmin, but that role has other permissions that are not needed by Ceilometer, posing a security risk.