// 1. Check S3 access for service account ListObjects()
	c.mustListObjects(ctx, svcClient, bucket)

	// 2. Check S3 access for upload
	c.mustUpload(ctx, svcClient, bucket)

	// 3. Check S3 access for download
	c.mustDownload(ctx, svcClient, bucket)
}

func (s *TestSuiteIAM) TestSTSWithDenyDeleteVersion(c *check) {

	xMinIOErrDescHeader = "x-minio-error-desc"
)

// Check if there are buckets on server without corresponding entry in etcd backend and
// make entries. Here is the general flow
// - Range over all the available buckets
// - Check if a bucket has an entry in etcd backend
// -- If no, make an entry
// -- If yes, check if the entry matches local IP check if we
//
//	need to update the entry then proceed to update
//

	}

	// We know XFS already supports O_DIRECT no need to check.
	if fsType == "XFS" {
		return nil
	}

	// For all other FS pay the price of not using our recommended filesystem.

	// Check if backend is writable and supports O_DIRECT
	uuid := mustGetUUID()
	filePath := pathJoin(s.drivePath, minioMetaTmpDeletedBucket, ".writable-check-"+uuid+".tmp")

	// Create top level directories if they don't exist.

	var updatedAt time.Time
	if updReq.IsRemove {
		updatedAt, err = globalIAMSys.RemoveUsersFromGroup(ctx, updReq.Group, updReq.Members)
	} else {
		// Check if group already exists
		if _, gerr := globalIAMSys.GetGroupDescription(updReq.Group); gerr != nil {
			// If group does not exist, then check if the group has beginning and end space characters
			// we will reject such group names.
			if errors.Is(gerr, errNoSuchGroup) && hasSpaceBE(updReq.Group) {

		}
		svcPolicies = newMappedPolicy(sys.rolesMap[arn]).toSlice()

	default:
		// Check policy for parent user of service account.
		svcPolicies, err = sys.PolicyDBGet(parentUser, args.Groups...)
		if err != nil {
			iamLogIf(GlobalContext, err)
			return false
		}

		// Finally, if there is no parent policy, check if a policy claim is
		// present.
		if len(svcPolicies) == 0 {

	_, found := cache.iamUsersMap[accessKey]

	// Check for regular user access key
	if !found {
		store.loadUser(ctx, accessKey, regUser, cache.iamUsersMap)
		if _, found = cache.iamUsersMap[accessKey]; found {
			// load mapped policies
			store.loadMappedPolicyWithRetry(ctx, accessKey, regUser, false, cache.iamUserPolicyMap, 3)
		}
	}

	// Check for service account
	if !found {

                @Suppress("USELESS_IS_CHECK") // K2 warning suppression, TODO: KT-62472
                require(fir is FirQualifiedAccessExpression)
                when (unsubstitutedKtSignature.symbol) {
                    is KtVariableLikeSymbol -> {
                        @Suppress("UNCHECKED_CAST") // safe because of the above check on targetKtSymbol
                        KtSimpleVariableAccessCall(

            .asSequence()
            .filter { withImplicitReceivers || it.implicitReceiver == null }
            .flatMap {
                // We must use `it.getAvailableScopes()` instead of `it.scope` to check scopes of companion objects
                // and context receivers as well.
                it.getAvailableScopes()
            }

        val result = buildList {
            addAll(nonLocalScopes)

			defer wg.Done()
			// remember the pool index, we may sort the slice original index might be lost.
			pinfo := PoolObjInfo{
				Index: i,
			}
			// do not remove this check as it can lead to inconsistencies
			// for all callers of bucket replication.
			if !opts.MetadataChg {
				opts.VersionID = ""
			}
			pinfo.ObjInfo, pinfo.Err = pool.GetObjectInfo(ctx, bucket, object, opts)

// which decides which condition it is useful to check if an object is dangling
//
//	  errs: errors from reading xl.meta in all disks
//	   err: reduced errs
//	bucket: the object name in question
func shouldCheckForDangling(err error, errs []error, bucket string) bool {
	// Avoid data in .minio.sys for now
	if bucket == minioMetaBucket {
		return false
	}
	switch {
	// Check if we have a read quorum issue