}

	denyOnly := (targetUser == cred.AccessKey || targetUser == cred.ParentUser)
	if ldap && !denyOnly {
		res, _ := globalIAMSys.LDAPConfig.GetValidatedDNForUsername(targetUser)
		if res != nil && res.NormDN == cred.ParentUser {
			denyOnly = true
		}
	}

	// Check if action is allowed if creating access key for another user