cache := store.rlock()
	defer store.runlock()

	userExists := false
	var tempAccounts []UserIdentity
	for _, v := range cache.iamUsersMap {
		isDerived := false
		if v.Credentials.IsServiceAccount() || v.Credentials.IsTemp() {
			isDerived = true
		}

		if !isDerived && v.Credentials.AccessKey == accessKey {
			userExists = true
		} else if isDerived && v.Credentials.ParentUser == accessKey {

		if userOrGroup == globalActiveCred.AccessKey {
			err = errIAMActionNotAllowed
			return
		}

		// Validate that user exists.
		var userExists bool
		_, userExists = sys.GetUser(ctx, userOrGroup)
		if !userExists {
			err = errNoSuchUser
			return
		}
	}

	updatedAt, addedOrRemoved, effectivePolicies, err = sys.store.PolicyDBUpdate(ctx, userOrGroup, isGroup,