var (
		terr        error
		taggedCount int
	)
	for _, err := range errs {
		if err == nil {
			taggedCount++
			continue
		}
		if err != nil {
			terr = err
		}
	}
	// don't return error if at least one target was tagged successfully
	if taggedCount == 0 && terr != nil {
		proxy.Err = terr
	}
	return proxy
}

			// Status is set without secretKey updates means we are
			// only changing the account status.
			_, err = globalIAMSys.SetUserStatus(ctx, change.AccessKey, userReq.Status)
		} else {
			// We don't allow internal user creation with LDAP enabled for now
			// (both sites must have LDAP disabled).
			if globalIAMSys.LDAPConfig.Enabled() {
				err = errIAMActionNotAllowed
			} else {

			// permission.
			// * If you have the s3:ListBucket permission
			//   on the bucket, Amazon S3 will return an
			//   HTTP status code 404 ("no such key")
			//   error.
			// * if you don’t have the s3:ListBucket
			//   permission, Amazon S3 will return an HTTP
			//   status code 403 ("access denied") error.`
			if globalPolicySys.IsAllowed(policy.BucketPolicyArgs{
				Action:          policy.ListBucketAction,

	}

	apiEndpoints := getAPIEndpoints()
	for _, ep := range apiEndpoints {
		if len(ep) == 0 {
			continue
		}
		if url, err := xnet.ParseHTTPURL(ep); err == nil {
			// In FS mode the drive names don't include the host.
			// So mapping just the host should be sufficient.
			hostAnonymizer[url.Host] = "server1"
		}
	}
	return hostAnonymizer
}

				rec := reqRec.rec
				// HTTP request used to call the handler.
				req := reqRec.req
				// HTTP request type string for V4/V2 requests.
				reqType := reqRec.reqType

				// Clone so we don't retain values we do not want.
				req.Header = req.Header.Clone()

				// introduce faults in the request.