c.Fatalf("Err creating svcacct admin client: %v", err)
	}
	svcAdmClient.SetCustomTransport(s.TestSuiteCommon.client.Transport)

	// Attempt to update the policy on the service account.
	err = svcAdmClient.UpdateServiceAccount(ctx, cr.AccessKey,
		madmin.UpdateServiceAccountReq{
			NewPolicy: fullS3PolicyBytes,
		})

	if err == nil {
		c.Fatalf("service account should not be able to update policy on itself")

	expiration        *time.Time
}

// UpdateServiceAccount - edit a service account
func (sys *IAMSys) UpdateServiceAccount(ctx context.Context, accessKey string, opts updateServiceAccountOpts) (updatedAt time.Time, err error) {
	if !sys.Initialized() {
		return updatedAt, errServerNotInitialized
	}

	updatedAt, err = sys.store.UpdateServiceAccount(ctx, accessKey, opts)
	if err != nil {
		return updatedAt, err

		adminRouter.Methods(http.MethodPost).Path(adminVersion+"/update-service-account").HandlerFunc(adminMiddleware(adminAPI.UpdateServiceAccount)).Queries("accessKey", "{accessKey:.*}")
		adminRouter.Methods(http.MethodGet).Path(adminVersion+"/info-service-account").HandlerFunc(adminMiddleware(adminAPI.InfoServiceAccount)).Queries("accessKey", "{accessKey:.*}")

	if err != nil {
		return updatedAt, err
	}

	cache.updateUserWithClaims(u.Credentials.AccessKey, u)

	return u.UpdatedAt, nil
}

// UpdateServiceAccount - updates a service account on storage.
func (store *IAMStoreSys) UpdateServiceAccount(ctx context.Context, accessKey string, opts updateServiceAccountOpts) (updatedAt time.Time, err error) {
	cache := store.lock()
	defer store.unlock()

			name:          change.Update.Name,
			description:   change.Update.Description,
			sessionPolicy: sp,
			expiration:    change.Update.Expiration,
		}

		_, err = globalIAMSys.UpdateServiceAccount(ctx, change.Update.AccessKey, opts)
		if err != nil {
			return wrapSRErr(err)
		}

	case change.Delete != nil:
		// skip overwrite of local update if peer sent stale info