AccessKey:  "restricted",
			SecretKey:  "restricted123",
		})
		if err != nil {
			c.Fatalf("could not create service account: %v", err)
		}
		defer func() {
			_ = s.adm.DeleteServiceAccount(ctx, "restricted")
			_ = s.adm.RemoveUser(ctx, "foobar")
		}()
	}
	restrictedClient := s.getUserClient(c, "restricted", "restricted123", "")

	buckets, err := restrictedClient.ListBuckets(ctx)