AssumeRoleWithWebIdentity implementation supports specifying IAM policies in two ways:

1. Role Policy (Recommended): When specified as part of the OpenID provider configuration, all users authenticating via this provider are authorized to (only) use the specified role policy. The policy to associate with such users is specified via the `role_policy` configuration parameter or the `MINIO_IDENTITY_OPENID_ROLE_POLICY` environment variable. The value is a comma-separated list of IAM access policy names...

from his book, `Rule Forty-two.  ALL PERSONS MORE THAN A MILE
HIGH TO LEAVE THE COURT.'

  Everybody looked at Alice.

  `I'M not a mile high,' said Alice.

  `You are,' said the King.

  `Nearly two miles high,' added the Queen.

  `Well, I shan't go, at any rate,' said Alice:  `besides,
that's not a regular rule:  you invented it just now.'

      <name>Jason van Zyl</name>
      <email>******@****.***</email>
      <roles>
        <role>Developer</role>
        <role>Release Manager</role>
      </roles>
    </developer>
    <developer>
      <id>kaz</id>
      <name>Pete Kazmier</name>
      <email />
      <organization />
      <roles>
        <role>Developer</role>
      </roles>
    </developer>
    <developer>
      <id>jtaylor</id>

      <name>Jason van Zyl</name>
      <email>******@****.***</email>
      <roles>
        <role>Developer</role>
        <role>Release Manager</role>
      </roles>
    </developer>
    <developer>
      <id>kaz</id>
      <name>Pete Kazmier</name>
      <email />
      <organization />
      <roles>
        <role>Developer</role>
      </roles>
    </developer>
    <developer>
      <id>jtaylor</id>

      <email>******@****.***</email>
      <roles>
        <role>Developer</role>
        <role>Release Manager</role>
      </roles>
    </developer>
    <developer>
      <id>kaz</id>
      <name>Pete Kazmier</name>
      <email></email>
      <organization></organization>
      <roles>
        <role>Developer</role>
      </roles>
    </developer>
    <developer>
      <id>jtaylor</id>

      <organization>Zenplex</organization>
      <roles>
        <role>Developer</role>
        <role>Release Manager</role>
      </roles>
    </developer>
    <developer>
      <id>kaz</id>
      <name>Pete Kazmier</name>
      <email></email>
      <organization></organization>
      <roles>
        <role>Developer</role>
      </roles>
    </developer>
    <developer>
      <id>jtaylor</id>

      <organization>ASF</organization>
      <roles>
        <role>PMC Chair</role>
      </roles>
      <timezone>-5</timezone>
    </developer>
    <developer>
      <id>brett</id>
      <name>Brett Porter</name>
      <email>******@****.***</email>
      <organization>ASF</organization>
      <roles>
        <role>PMC Member</role>
      </roles>
      <timezone>+10</timezone>
    </developer>

      <name>Joe Walnes</name>
      <roles>
        <role>Developer</role>
      </roles>
    </developer>
    <developer>
      <id>nat.pryce</id>
      <name>Nat Pryce</name>
      <roles>
        <role>Developer</role>
      </roles>
    </developer>
    <developer>
      <id>smgfreeman</id>
      <name>Steve Freeman</name>
      <roles>
        <role>Developer</role>
      </roles>
    </developer>
    <developer>

    val rule = findMatchingRule(domainLabels)
    if (domainLabels.size == rule.size && rule[0][0] != EXCEPTION_MARKER) {
      return null // The domain is a public suffix.
    }

    val firstLabelOffset =
      if (rule[0][0] == EXCEPTION_MARKER) {
        // Exception rules hold the effective TLD plus one.
        domainLabels.size - rule.size
      } else {

test-versioning: install-race
	@echo "Running minio versioning tests"
	@env bash $(PWD)/docs/bucket/versioning/versioning-tests.sh

test-configfile: install-race
	@env bash $(PWD)/docs/distributed/distributed-from-config-file.sh

test-upgrade: install-race
	@echo "Running minio upgrade tests"
	@(env bash $(PWD)/buildscripts/minio-upgrade.sh)

test-race: verifiers build ## builds minio, runs linters, tests (race)