diff --git a/pkg/cloudcommon/db/scoperesource.go b/pkg/cloudcommon/db/scoperesource.go
index 8e911ee66d..bba0ad23da 100644
--- a/pkg/cloudcommon/db/scoperesource.go
+++ b/pkg/cloudcommon/db/scoperesource.go
@@ -116,9 +116,33 @@ func (m *SScopedResourceBaseManager) FilterByOwner(q *sqlchemy.SQuery, userCred
 	}
 	switch scope {
 	case rbacutils.ScopeDomain:
-		q = q.Equals("domain_id", userCred.GetProjectDomainId())
+		q = q.Filter(sqlchemy.OR(
+			// share to system
+			sqlchemy.AND(
+				sqlchemy.IsNullOrEmpty(q.Field("domain_id")),
+				sqlchemy.IsNullOrEmpty(q.Field("tenant_id")),
+			),
+			// share to this domain or its sub-projects
+			sqlchemy.Equals(q.Field("domain_id"), userCred.GetProjectDomainId()),
+		))
 	case rbacutils.ScopeProject:
-		q = q.Equals("tenant_id", userCred.GetProjectId())
+		q = q.Filter(sqlchemy.OR(
+			// share to system
+			sqlchemy.AND(
+				sqlchemy.IsNullOrEmpty(q.Field("domain_id")),
+				sqlchemy.IsNullOrEmpty(q.Field("tenant_id")),
+			),
+			// share to project's parent domain
+			sqlchemy.AND(
+				sqlchemy.Equals(q.Field("domain_id"), userCred.GetProjectDomainId()),
+				sqlchemy.IsNullOrEmpty(q.Field("tenant_id")),
+			),
+			// share to this project
+			sqlchemy.AND(
+				sqlchemy.Equals(q.Field("domain_id"), userCred.GetProjectDomainId()),
+				sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId()),
+			),
+		))
 	}
 	return q
 }