if bucketName == "" || v.Policy.MatchResource(bucketName) {
			ret[k] = v
		}
	}
	return ret, nil
}

// helper function - does not take locks.
func filterPolicies(cache *iamCache, policyName string, bucketName string) (string, policy.Policy) {
	var policies []string
	mp := newMappedPolicy(policyName)
	var toMerge []policy.Policy
	for _, policy := range mp.toSlice() {