evt := evts[0]
	if evt.Action != TransitionAction {
		t.Fatalf("Expected action: %s but got %s", TransitionAction, evt.Action)
	}
	if evt.StorageClass != "TIER-1" {
		t.Fatalf("Expected TIER-1 but got %s", evt.StorageClass)
	}

	evt = evts[1]
	if evt.Action != TransitionVersionAction {
		t.Fatalf("Expected action: %s but got %s", TransitionVersionAction, evt.Action)
	}
	if evt.StorageClass != "TIER-2" {

	policyBytes := fmt.Appendf(nil, `{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Action": [
    "s3:ListBucket"
   ],
   "Resource": [
    "arn:aws:s3:::%s"
   ]
  },
  {
   "Effect": "Allow",
   "Action": [
    "s3:PutObject",
    "s3:GetObject"
   ],
   "Resource": [
    "arn:aws:s3:::%s/*"
   ]
  }
 ]

		if res != nil && res.NormDN == cred.ParentUser {
			denyOnly = true
		}
	}

	// Check if action is allowed if creating access key for another user
	// Check if action is explicitly denied if for self
	if !globalIAMSys.IsAllowed(policy.Args{
		AccountName:     cred.AccessKey,
		Groups:          cred.Groups,
		Action:          policy.CreateServiceAccountAdminAction,
		ConditionValues: condValues,
		IsOwner:         owner,

common --action_env=PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=upb
# Some targets have the same py source file, but use different
# configurations via `requires-` tags. This results in an action
# conflict when precompiling. Disable to avoid that problem.
# See https://github.com/bazel-contrib/rules_python/issues/2445
common --@rules_python//python/config_settings:precompile=force_disabled

			return err
		}
		return saveConfig(ctx, api, path, buf)
	}
	ri.mu.Unlock()
	return nil
}

// Note: to be used only with batch jobs that affect multiple versions through
// a single action. e.g batch-expire has an option to expire all versions of an
// object which matches the given filters.
func (ri *batchJobInfo) trackMultipleObjectVersions(info expireObjInfo, success bool) {
	if ri == nil {
		return