if err != nil {
		c.Fatalf("unable to list svc accounts: %v", err)
	}
	var accessKeys []string
	for _, item := range listResp.Accounts {
		accessKeys = append(accessKeys, item.AccessKey)
	}
	if !set.CreateStringSet(accessKeys...).Contains(svcAK) {
		c.Fatalf("service account did not appear in listing!")
	}
}

	cache := store.rlock()
	defer store.runlock()

	accessKeys := store.getSTSAndServiceAccounts(cache)
	for i, accessKey := range accessKeys {
		accessKeys[i].SecretKey = ""
		if accessKey.IsTemp() {
			secret, err := getTokenSigningKey()
			if err != nil {
				return nil, err
			}
			claims, err := getClaimsFromTokenWithSecret(accessKey.SessionToken, secret)
			if err != nil {

		return
	}

	accessKey := mux.Vars(r)["accessKey"]
	if accessKey == "" {
		accessKey = cred.AccessKey
	}

	u, ok := globalIAMSys.GetUser(ctx, accessKey)
	targetCred := u.Credentials

	if !globalIAMSys.IsAllowed(policy.Args{
		AccountName:     cred.AccessKey,
		Groups:          cred.Groups,

	switch {
	case usersPrefix:
		accessKey := path.Dir(strings.TrimPrefix(event.keyPath, iamConfigUsersPrefix))
		err = sys.store.UserNotificationHandler(ctx, accessKey, regUser)
	case stsPrefix:
		accessKey := path.Dir(strings.TrimPrefix(event.keyPath, iamConfigSTSPrefix))
		err = sys.store.UserNotificationHandler(ctx, accessKey, stsUser)
	case svcPrefix:

	return nil
}

// Sign given request using Signature V2.
func signRequestV2(req *http.Request, accessKey, secretKey string) error {
	signer.SignV2(*req, accessKey, secretKey, false)
	return nil
}

// Sign given request using Signature V4.
func signRequestV4(req *http.Request, accessKey, secretKey string) error {
	// Get hashed payload.
	hashedPayload := req.Header.Get("x-amz-content-sha256")

	if objAPI == nil {
		return np, grid.NewRemoteErr(errServerNotInitialized)
	}

	accessKey := mss.Get(peerRESTUser)
	if accessKey == "" {
		return np, grid.NewRemoteErr(errors.New("service account name is missing"))
	}

	if err := globalIAMSys.DeleteServiceAccount(context.Background(), accessKey, false); err != nil {
		return np, grid.NewRemoteErr(err)
	}

	return np, nerr
}

		if !globalIAMSys.IsAllowed(policy.Args{
			AccountName:     cred.AccessKey,
			Groups:          cred.Groups,
			Action:          policy.PutObjectFanOutAction,
			ConditionValues: getConditionValues(r, "", cred),
			BucketName:      bucket,
			ObjectName:      object,
			IsOwner:         globalActiveCred.AccessKey == cred.AccessKey,
			Claims:          cred.Claims,
		}) {

	}

	u, err := url.Parse(r.Source.Endpoint)
	if err != nil {
		return err
	}

	cred := r.Source.Creds

	c, err := minio.New(u.Host, &minio.Options{
		Creds:        credentials.NewStaticV4(cred.AccessKey, cred.SecretKey, cred.SessionToken),
		Secure:       u.Scheme == "https",
		Transport:    getRemoteInstanceTransport(),
		BucketLookup: lookupStyle(r.Source.Path),
	})
	if err != nil {
		return err
	}

 *
 * <p>If {@link #expireAfterWrite expireAfterWrite} or {@link #expireAfterAccess expireAfterAccess}
 * is requested entries may be evicted on each cache modification, on occasional cache accesses, or
 * on calls to {@link Cache#cleanUp}. Expired entries may be counted by {@link Cache#size}, but will
 * never be visible to read or write operations.
 *

 *
 * <p>If {@link #expireAfterWrite expireAfterWrite} or {@link #expireAfterAccess expireAfterAccess}
 * is requested entries may be evicted on each cache modification, on occasional cache accesses, or
 * on calls to {@link Cache#cleanUp}. Expired entries may be counted by {@link Cache#size}, but will
 * never be visible to read or write operations.
 *