SecretKey: "newroot123",
	})
	if err == nil {
		c.Fatalf("restricted service account was able to create service account bypassing sub-policy!")
	}
}

func (s *TestSuiteIAM) SetUpAccMgmtPlugin(c *check) {
	ctx, cancel := context.WithTimeout(context.Background(), testDefaultTimeout)
	defer cancel()

	pluginEndpoint := env.Get("_MINIO_POLICY_PLUGIN_ENDPOINT", "")
	if pluginEndpoint == "" {

				defer suite.TearDownSuite(c)

				err := suite.SetUpOpenIDs(c, testApps, rolePolicies)
				if err != nil {
					c.Fatalf("Error setting up openid providers for tests: %v", err)
				}

				suite.SetUpAccMgmtPlugin(c)

				suite.TestOpenIDSTSWithRolePolicyUnderAMP(c, testRoleARNs[0], testRoleMap[testRoleARNs[0]])
				suite.TestOpenIDSTSWithRolePolicyUnderAMP(c, testRoleARNs[1], testRoleMap[testRoleARNs[1]])