arn = dummyRoleARN
		}
		matchingCfgName, ok := roleArnMap[arn]
		if !ok {
			continue // skip if not part of the target config
		}
		var id string
		if idClaim := globalIAMSys.OpenIDConfig.GetUserIDClaim(matchingCfgName); idClaim != "" {
			id, _ = accessKey.Claims[idClaim].(string)
		}
		if !userSet.IsEmpty() && !userSet.Contains(accessKey.ParentUser) && !userSet.Contains(id) {
			continue // skip if not in the user list