```

### 2. Create a sample OPA Policy

In another terminal, create a policy that allows root user all access and for all other users denies `PutObject`:

```sh
cat > example.rego <<EOF
package httpapi.authz

import input

default allow = false

# Allow the root user to perform any action.
allow {
 input.owner == true
}

        AvgAggregationBuilder builder = AggregationBuilders.avg(name).field(field);
        regA(builder);
        return builder;
    }

    protected MaxAggregationBuilder regMaxA(String name, String field) {
        MaxAggregationBuilder builder = AggregationBuilders.max(name).field(field);
        regA(builder);
        return builder;
    }

    protected MinAggregationBuilder regMinA(String name, String field) {

	<property name="modules.dir" value="${basedir}/modules" />
	<property name="target.dir" value="${basedir}/target/modules" />

	<!-- Maven Repository -->
	<property name="maven.snapshot.repo.url" value="https://maven.codelibs.org/" />
	<property name="maven.release.repo.url" value="https://maven.codelibs.org/" />
	<property name="opensearch.version" value="2.17.1" />

	<target name="install.modules">
		<mkdir dir="${target.dir}" />

        } else {
            // process the list
            String[] repos = pattern.split(",");
            for (String repo : repos) {
                repo = repo.trim();
                // see if this is a negative match
                if (repo.length() > 1 && repo.startsWith("!")) {
                    if (repo.substring(1).equals(originalId)) {
                        // explicitly exclude. Set result and stop processing.

			<param name="repo.url" value="${maven.release.repo.url}" />
			<param name="plugin.groupId" value="org/codelibs/opensearch" />
			<param name="plugin.name.prefix" value="opensearch-" />
			<param name="plugin.name" value="configsync" />
			<param name="plugin.version" value="2.17.1" />
			<param name="plugin.zip.version" value="2.17.1" />
		</antcall>
		<!-- minhash -->
		<antcall target="install.plugin">

        if (selector != null) {
            RemoteRepository repo = RepositoryUtils.toRepo(repository);
            org.eclipse.aether.repository.Authentication auth = selector.getAuthentication(repo);
            if (auth != null) {
                repo = new RemoteRepository.Builder(repo)
                        .setAuthentication(auth)
                        .build();

  <repositories>
    <repository>
      <id>repo</id>
      <url>file://${basedir}/target/remote-repo</url>
    </repository>
    <repository>
      <id>repo-project-basedir</id>
      <url>file://${project.basedir}/sdk/maven/repo</url>
    </repository>
    <repository>
      <id>repo-project-baseUri</id>
      <url>${project.baseUri}/sdk/maven/repo</url>
    </repository>
  </repositories>

            boolQuery.filter(query);
        });
        regQ(boolQuery);
        return boolQuery;
    }

    protected TermQueryBuilder regTermQ(String name, Object value) {
        checkEsInvalidQuery(name, value);
        TermQueryBuilder termQuery = QueryBuilders.termQuery(name, value);
        regQ(termQuery);
        return termQuery;
    }

            boolQuery.filter(query);
        });
        regQ(boolQuery);
        return boolQuery;
    }

    protected TermQueryBuilder regTermQ(String name, Object value) {
        checkEsInvalidQuery(name, value);
        TermQueryBuilder termQuery = QueryBuilders.termQuery(name, value);
        regQ(termQuery);
        return termQuery;
    }

        Profile profile = new Profile();
        Repository repo = new Repository();
        repo.setId("local");
        profile.addRepository(repo);
        repo = new Repository();
        repo.setId("illegal\\:/chars");
        repo.setUrl("http://void");
        profile.addRepository(repo);
        Settings settings = new Settings();
        settings.addProfile(profile);