and in string comparisons in the *Condition* element.

You can use a policy variable in the Resource element, but only in the resource portion of the ARN. This portion of the ARN appears after the 5th colon (:). You can't use a variable to replace parts of the ARN before the 5th colon, such as the service or account. The following policy might be attached to a group. It gives each of the users in the group full programmatic access to a user-specific object (their own "home directory") in MinIO....

0.00 3.1 0.0 57 35 5.82 1281 407 4 Queens 040700 4040700 E QN26 North Corona 4102 1720 437.01 4 Queens 043701 4043701 E QN25 Corona 4107 3389265 1 2014-03-11 04:22:25 2014-03-11 04:26:32 N 1 -73.863510131835937 40.749954223632812 -73.856758117675781 40.745086669921875 1 0.60 5 0.5 0.5 0 0 6 2 173 56 green 0.00 0.0 0.0 66 45 4.70 1281 407 4 Queens 040700 4040700 E QN26 North Corona 4102 653 415 4 Queens 041500 4041500 E QN25 Corona 4107 3389266 2 2014-03-24 00:27:53 2014-03-24 00:31:52 N 1 -73.8636474609375...

			}, nil
		},
		RoleARN: roleARN,
	}

	value, err := webID.Retrieve()
	if err != nil {
		log.Fatalf("Expected to generate credentials: %v", err)
	}

	// Print credentials separated by colons:
	fmt.Printf("%s:%s:%s\n", value.AccessKeyID, value.SecretAccessKey, value.SessionToken)

	// e.g. Forwarded: for=192.0.2.60;proto=https;by=203.0.113.43
	forwarded = http.CanonicalHeaderKey("Forwarded")
	// Allows for a sub-match of the first value after 'for=' to the next
	// comma, semi-colon or space. The match is case-insensitive.
	forRegex = regexp.MustCompile(`(?i)(?:for=)([^(;|,| )]+)(.*)`)
	// Allows for a sub-match for the first instance of scheme (http|https)
	// prefixed by 'proto='. The match is case-insensitive.

	urlStr := uu.String()
	u, err := url.Parse(urlStr)
	if err != nil {
		// Mark offline, with no reconnection attempts.
		connected = int32(offline)
		err = &url.Error{URL: urlStr, Err: err}
	}
	// The host's colon:port should be normalized. See Issue 14836.
	u.Host = removeEmptyPort(u.Host)

	// Transport is exactly same as Go default in https://golang.org/pkg/net/http/#RoundTripper
	// except custom DialContext and TLSClientConfig.