diff --git a/keystone/common/environment/__init__.py b/keystone/common/environment/__init__.py
index 8f8ca1b88c..77eecee3a6 100644
--- a/keystone/common/environment/__init__.py
+++ b/keystone/common/environment/__init__.py
@@ -15,10 +15,8 @@
 import functools
 import os
 
-from keystone.common import config
 from keystone.openstack.common import log
 
-CONF = config.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/contrib/access/core.py b/keystone/contrib/access/core.py
index 6e30ccc860..f56bd37e37 100644
--- a/keystone/contrib/access/core.py
+++ b/keystone/contrib/access/core.py
@@ -16,12 +16,10 @@ from oslo.utils import timeutils
 import webob.dec
 
 from keystone.common import wsgi
-from keystone import config
 from keystone.openstack.common import log
 from keystone.openstack.common import versionutils
 
 
-CONF = config.CONF
 LOG = log.getLogger('access')
 APACHE_TIME_FORMAT = '%d/%b/%Y:%H:%M:%S'
 APACHE_LOG_FORMAT = (
diff --git a/keystone/contrib/ec2/core.py b/keystone/contrib/ec2/core.py
index 9f1f85f02f..77857af809 100644
--- a/keystone/contrib/ec2/core.py
+++ b/keystone/contrib/ec2/core.py
@@ -13,9 +13,6 @@
 # under the License.
 
 from keystone.common import extension
-from keystone import config
-
-CONF = config.CONF
 
 
 EXTENSION_DATA = {
diff --git a/keystone/contrib/example/core.py b/keystone/contrib/example/core.py
index c3e6c3cf1c..7edb03329d 100644
--- a/keystone/contrib/example/core.py
+++ b/keystone/contrib/example/core.py
@@ -15,13 +15,11 @@
 
 from keystone.common import dependency
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.openstack.common import log
 
 
-CONF = config.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/contrib/federation/controllers.py b/keystone/contrib/federation/controllers.py
index 1ba659ba70..af714ae1ee 100644
--- a/keystone/contrib/federation/controllers.py
+++ b/keystone/contrib/federation/controllers.py
@@ -17,13 +17,9 @@ from keystone.common import authorization
 from keystone.common import controller
 from keystone.common import dependency
 from keystone.common import wsgi
-from keystone import config
 from keystone.contrib.federation import utils
 
 
-CONF = config.CONF
-
-
 class _ControllerBase(controller.V3Controller):
     """Base behaviors for federation controllers."""
 
diff --git a/keystone/contrib/revoke/backends/sql.py b/keystone/contrib/revoke/backends/sql.py
index d5dc658a6b..6c12974665 100644
--- a/keystone/contrib/revoke/backends/sql.py
+++ b/keystone/contrib/revoke/backends/sql.py
@@ -12,15 +12,11 @@
 
 import uuid
 
-from keystone.common import config
 from keystone.common import sql
 from keystone.contrib import revoke
 from keystone.contrib.revoke import model
 
 
-CONF = config.CONF
-
-
 class RevocationEvent(sql.ModelBase, sql.ModelDictMixin):
     __tablename__ = 'revocation_event'
     attributes = model.REVOKE_KEYS
diff --git a/keystone/contrib/s3/core.py b/keystone/contrib/s3/core.py
index b21013e5b6..2bf96c413b 100644
--- a/keystone/contrib/s3/core.py
+++ b/keystone/contrib/s3/core.py
@@ -28,12 +28,9 @@ import hmac
 from keystone.common import extension
 from keystone.common import utils
 from keystone.common import wsgi
-from keystone import config
 from keystone.contrib.ec2 import controllers
 from keystone import exception
 
-CONF = config.CONF
-
 EXTENSION_DATA = {
     'name': 'OpenStack S3 API',
     'namespace': 'http://docs.openstack.org/identity/api/ext/'
diff --git a/keystone/controllers.py b/keystone/controllers.py
index 6f9f631e08..55d0736fb0 100644
--- a/keystone/controllers.py
+++ b/keystone/controllers.py
@@ -14,13 +14,11 @@
 
 from keystone.common import extension
 from keystone.common import wsgi
-from keystone import config
 from keystone import exception
 from keystone.openstack.common import log
 
 
 LOG = log.getLogger(__name__)
-CONF = config.CONF
 
 MEDIA_TYPE_JSON = 'application/vnd.openstack.identity-%s+json'
 MEDIA_TYPE_XML = 'application/vnd.openstack.identity-%s+xml'
diff --git a/keystone/tests/test_backend_federation_sql.py b/keystone/tests/test_backend_federation_sql.py
index 93464e06eb..0516ad60ec 100644
--- a/keystone/tests/test_backend_federation_sql.py
+++ b/keystone/tests/test_backend_federation_sql.py
@@ -13,11 +13,8 @@
 # under the License.
 
 from keystone.common import sql
-from keystone import config
 from keystone.tests import test_backend_sql
 
-CONF = config.CONF
-
 
 class SqlFederation(test_backend_sql.SqlModels):
     """Set of tests for checking SQL Federation."""
diff --git a/keystone/tests/test_exception.py b/keystone/tests/test_exception.py
index a7cb7c3e3b..aaa0b93fe5 100644
--- a/keystone/tests/test_exception.py
+++ b/keystone/tests/test_exception.py
@@ -17,15 +17,11 @@ import uuid
 import six
 
 from keystone.common import wsgi
-from keystone import config
 from keystone import exception
 from keystone.openstack.common import jsonutils
 from keystone import tests
 
 
-CONF = config.CONF
-
-
 class ExceptionTestCase(tests.TestCase):
     def assertValidJsonRendering(self, e):
         resp = wsgi.render_exception(e)
diff --git a/keystone/tests/test_keystoneclient_sql.py b/keystone/tests/test_keystoneclient_sql.py
index d2df06758f..a05ad5932f 100644
--- a/keystone/tests/test_keystoneclient_sql.py
+++ b/keystone/tests/test_keystoneclient_sql.py
@@ -17,14 +17,10 @@ import uuid
 
 from keystoneclient.contrib.ec2 import utils as ec2_utils
 
-from keystone import config
 from keystone import tests
 from keystone.tests import test_keystoneclient
 
 
-CONF = config.CONF
-
-
 class KcMasterSqlTestCase(test_keystoneclient.KcMasterTestCase):
     def config_files(self):
         config_files = super(KcMasterSqlTestCase, self).config_files()
diff --git a/keystone/tests/test_policy.py b/keystone/tests/test_policy.py
index dbe8e71da9..b076ca4abc 100644
--- a/keystone/tests/test_policy.py
+++ b/keystone/tests/test_policy.py
@@ -21,16 +21,12 @@ import six
 from six.moves.urllib import request as urlrequest
 from testtools import matchers
 
-from keystone import config
 from keystone import exception
 from keystone.openstack.common import policy as common_policy
 from keystone.policy.backends import rules
 from keystone import tests
 
 
-CONF = config.CONF
-
-
 class PolicyFileTestCase(tests.TestCase):
     def setUp(self):
         # self.tmpfilename should exist before setUp super is called
diff --git a/keystone/tests/test_revoke.py b/keystone/tests/test_revoke.py
index 960de0282b..07d0c1c969 100644
--- a/keystone/tests/test_revoke.py
+++ b/keystone/tests/test_revoke.py
@@ -19,16 +19,12 @@ from oslo.utils import timeutils
 from testtools import matchers
 
 from keystone.common import dependency
-from keystone import config
 from keystone.contrib.revoke import model
 from keystone import exception
 from keystone import tests
 from keystone.tests import test_backend_sql
 
 
-CONF = config.CONF
-
-
 def _new_id():
     return uuid.uuid4().hex
 
diff --git a/keystone/tests/test_sql_livetest.py b/keystone/tests/test_sql_livetest.py
index 9f64220342..83b726de06 100644
--- a/keystone/tests/test_sql_livetest.py
+++ b/keystone/tests/test_sql_livetest.py
@@ -12,15 +12,11 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-from keystone import config
 from keystone import tests
 from keystone.tests import test_sql_migrate_extensions
 from keystone.tests import test_sql_upgrade
 
 
-CONF = config.CONF
-
-
 class PostgresqlMigrateTests(test_sql_upgrade.SqlUpgradeTests):
     def setUp(self):
         self.skip_if_env_not_set('ENABLE_LIVE_POSTGRES_TEST')
diff --git a/keystone/trust/controllers.py b/keystone/trust/controllers.py
index 9416938338..da30046f2e 100644
--- a/keystone/trust/controllers.py
+++ b/keystone/trust/controllers.py
@@ -20,14 +20,12 @@ import six
 from keystone import assignment
 from keystone.common import controller
 from keystone.common import dependency
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.openstack.common import log
 
 
 LOG = log.getLogger(__name__)
-CONF = config.CONF
 
 
 def _trustor_trustee_only(trust, user_id):