if err != nil {
		c.Fatalf("error listing: %v", err)
	}
	v, ok := usersMap[accessKey]
	if !ok {
		c.Fatalf("user not listed: %s", accessKey)
	}
	c.Assert(v.Status, madmin.AccountEnabled)

	// 3. Associate policy and check that user can access
	_, err = s.adm.AttachPolicy(ctx, madmin.PolicyAssociationReq{
		Policies: []string{"readwrite"},
		User:     accessKey,
	})
	if err != nil {

In case of certificate-based authentication, MinIO has to map the client-provided certificate to an S3 policy. MinIO does this via the subject common name field of the X.509 certificate. So, MinIO will associate a certificate with a subject `CN = foobar` to a S3 policy named `foobar`.

    /**
     * Adds a CORS handler for the specified origin.
     *
     * @param origin the origin pattern (can be "*" for wildcard)
     * @param handler the CORS handler to associate with the origin
     */
    public void add(final String origin, final CorsHandler handler) {
        if (logger.isDebugEnabled()) {
            logger.debug("Loaded CorsHandler: origin={}", origin);
        }

     * For other types of values, they are registered directly.
     *
     * @param data the RenderData object to register the value in
     * @param key the key to associate with the value
     * @param value the value to register; can be null, Entity, Collection, or any other object
     */
    public static void register(final RenderData data, final String key, final Object value) {

    /**
     * Sets the InputLocation for a specific nested element key.
     *
     * @param key the key to set the location for
     * @param location the InputLocation to associate with the key
     */
    @Override
    public void setLocation(Object key, InputLocation location) {
        if (key instanceof String string) {
            switch (string) {
                case "": {

     *
     * @param key
     *            cache key
     */
    void setKey(String key);

    /**
     * Set the cache map for this referral
     *
     * @param map the cache map to associate with this referral
     */
    void setCacheMap(Map<String, DfsReferralDataInternal> map);

    /**
     * Replaces the entry with key in the cache map with this referral
     */
    void replaceCache();

    private static final long serialVersionUID = 1L;

    /**
     * The internal LRU hash map used to store elements.
     */
    private final LruHashMap<E, Object> map;

    // Dummy value to associate with an Object in the backing Map
    private static final Object PRESENT = new Object();

    /**
     * Creates a new {@link LruHashSet} with the specified limit size.
     *
     * @param limitSize

Transition tiers can be added to MinIO using `mc admin tier add` command to associate a `gcs`, `s3` or `azure` bucket or prefix path on a bucket to the tier name.

	// Set stores the given Stmt object in the store and associates it with the specified key.
	// Parameters:
	//   key: The key used to associate the Stmt object.
	//   value: The Stmt object to be stored.
	Set(key string, value *Stmt)

	// Delete removes the Stmt object corresponding to the specified key from the store.
	// Parameters:
	//   key: The key associated with the Stmt object to be deleted.
	Delete(key string)
}

- The user can now use these credentials to make requests to the MinIO server.

The administrator will associate IAM access policies with each group and if required with the user too. The MinIO server then evaluates applicable policies on a user (these are the policies associated with the groups along with the policy on the user if any) to check if the request should be allowed or denied.