m.Set(policy.SessionPolicyName, base64.StdEncoding.EncodeToString(policyBuf))
			m.Set(iamPolicyClaimNameSA(), embeddedPolicyType)
		}
	}

	cr.SessionToken, err = auth.JWTSignWithAccessKey(accessKey, m.Map(), cr.SecretKey)
	if err != nil {
		return updatedAt, err
	}

	u := newUserIdentity(cr)
	if err := store.saveUserIdentity(ctx, u.Credentials.AccessKey, svcUser, u); err != nil {