Transport:       globalRemoteTargetTransport,
		TrailingHeaders: true,
	}
	client, err := minio.New(u.Host, opts)
	if err != nil {
		return nil, err
	}
	client.SetAppInfo(fmt.Sprintf("minio-tier-%s", tier), ReleaseTag)

	core := &minio.Core{Client: client}
	return &warmBackendMinIO{
		warmBackendS3{
			client: client,
			core:   core,
			Bucket: conf.Bucket,

	client, err := storage.NewClient(context.Background(),
		option.WithCredentialsJSON(credsJSON),
		option.WithScopes(storage.ScopeReadWrite),
		option.WithHTTPClient(clnt),
		option.WithUserAgent(fmt.Sprintf("gcs-tier-%s", tier)+SlashSeparator+ReleaseTag),
	)
	if err != nil {
		return nil, err
	}
	return &warmBackendGCS{client, conf.Bucket, conf.Prefix, conf.StorageClass}, nil
}

#### Bucket quota management permissions

- admin:SetBucketQuota
- admin:GetBucketQuota

#### Bucket target management permissions

- admin:SetBucketTarget
- admin:GetBucketTarget

#### Remote tier management permissions

- admin:SetTier
- admin:ListTier

#### Give full admin permissions

- admin:*

### 5. Using an external IDP for admin users

}

func stsLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "sts", err, errKind...)
}

func tierLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "tier", err, errKind...)
}

func kmsLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "kms", err, errKind...)
}

// KMSLogger permits access to kms module specific logging