}

	// Try to escalate privileges
	restrictedAdmClient := s.getAdminClient(c, value.AccessKeyID, value.SecretAccessKey, value.SessionToken)
	_, err = restrictedAdmClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
		AccessKey: "newroot",
		SecretKey: "newroot123",
	})
	if err == nil {
		c.Fatalf("restricted STS account was able to create service account bypassing sub-policy!")
	}
}