defer store.unlock()

	// Load existing policy mapping
	var mp MappedPolicy
	if !isGroup {
		if userType == stsUser {
			stsMap := xsync.NewMapOf[string, MappedPolicy]()

			// Attempt to load parent user mapping for STS accounts
			store.loadMappedPolicy(context.TODO(), name, stsUser, false, stsMap)

			mp, _ = stsMap.Load(name)
		} else {
			mp, _ = cache.iamUserPolicyMap.Load(name)
		}

	var basePrefix string
	switch userType {
	case svcUser:
		basePrefix = iamConfigServiceAccountsPrefix
	case stsUser:
		basePrefix = iamConfigSTSPrefix
	default:
		basePrefix = iamConfigUsersPrefix
	}

	ctx, cancel := context.WithCancel(ctx)
	defer cancel()

func (ies *IAMEtcdStore) loadUsers(ctx context.Context, userType IAMUserType, m map[string]UserIdentity) error {
	var basePrefix string
	switch userType {
	case svcUser:
		basePrefix = iamConfigServiceAccountsPrefix
	case stsUser:
		basePrefix = iamConfigSTSPrefix
	default:
		basePrefix = iamConfigUsersPrefix
	}

	cctx, cancel := context.WithTimeout(ctx, defaultContextTimeout)
	defer cancel()

		var oldDN string
		if isGroup {
			oldDN = r.Group
		} else {
			oldDN = r.User
		}
		if oldDN != dn {
			sys.store.PolicyDBUpdate(ctx, oldDN, isGroup, stsUser, r.Policies, isAttach)
		}
	}

	userType := stsUser
	updatedAt, addedOrRemoved, effectivePolicies, err = sys.store.PolicyDBUpdate(
		ctx, dn, isGroup, userType, r.Policies, isAttach)
	if err != nil {
		return
	}