bucketPolicyTemplate := `{"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetBucketLocation","s3:ListBucket"],"Resource":["arn:aws:s3:::%s"]},{"Sid":"","Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::%s/this*"]}]}`

    }

    @Override
    public SID getOwnerUser() throws IOException {
        return getOwnerUser(true);
    }

    @Override
    public SID getOwnerUser(final boolean resolve) throws IOException {
        try (SmbTreeHandleImpl th = ensureTreeConnected()) {
            final SecurityDescriptor desc = querySecurity(th, SecurityInfo.OWNER_SECURITY_INFO);
            final SID ownerUser = desc.getOwnerUserSid();

```json
cat > getonly.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
	{
	  "Action": [
		"s3:GetObject"
	  ],
	  "Effect": "Allow",
	  "Resource": [
		"arn:aws:s3:::my-bucketname/*"
	  ],
	  "Sid": ""
	}
  ]
}
EOF
```

Create new canned policy by name `getonly` using `getonly.json` policy file.

```
mc admin policy create myminio getonly getonly.json
```

                    throw new OpenSearchAccessException(bulkResponse.buildFailureMessage());
                }

                final String sid = scrollId;
                response = getClient().get(c -> c.prepareSearchScroll(sid).setScroll(new TimeValue(scrollTimeout)).execute());
                if (!scrollId.equals(response.getScrollId())) {
                    getClient().clearScroll(scrollId);

```
{
 "Version": "2012-10-17",
 "Statement": [
  {
    "Action": [
        "admin:SetBucketTarget",
        "admin:GetBucketTarget"
    ],
    "Effect": "Allow",
    "Sid": ""
  },
  {
   "Effect": "Allow",
   "Action": [
    "s3:GetReplicationConfiguration",
    "s3:PutReplicationConfiguration",
    "s3:ListBucket",
    "s3:ListBucketMultipartUploads",

    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucket1AndBucket2",
            "Effect": "Allow",
            "Action": ["s3:ListBucket"],
            "Resource": ["arn:aws:s3:::bucket1", "arn:aws:s3:::bucket2"]
        },
        {
            "Sid": "ReadWriteBucket1AndBucket2Objects",
            "Effect": "Allow",
            "Action": [

	// to test a mixed response of a successful & failure while deleting objects in a single request
	policyBytes := fmt.Appendf(nil, `{"Id": "Policy1637752602639", "Version": "2012-10-17", "Statement": [{"Sid": "Stmt1637752600730", "Action": "s3:DeleteObject", "Effect": "Allow", "Resource": "arn:aws:s3:::%s/public/*", "Principal": "*"}]}`, bucketName)
	rec := httptest.NewRecorder()

    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucket1AndBucket2",
            "Effect": "Allow",
            "Action": ["s3:ListBucket"],
            "Resource": ["arn:aws:s3:::bucket1", "arn:aws:s3:::bucket2"]
        },
        {
            "Sid": "ReadWriteBucket1AndBucket2Objects",
            "Effect": "Allow",
            "Action": [

     *
     * @param policyHandle the LSA policy handle
     * @param sids the array of SIDs to lookup
     */
    public MsrpcLookupSids(final LsaPolicyHandle policyHandle, final jcifs.SID[] sids) {
        super(policyHandle, new LsarSidArrayX(sids), new jcifs.dcerpc.msrpc.lsarpc.LsarRefDomainList(),
                new jcifs.dcerpc.msrpc.lsarpc.LsarTransNameArray(), (short) 1, sids.length);
        this.ptype = 0;

        assertNotNull(capturedRpc);
        assertEquals(mockPolicyHandle, capturedRpc.handle);
        assertEquals(access, capturedRpc.access_mask);
        assertEquals(mockSid, capturedRpc.sid);
        assertEquals(handle, capturedRpc.domain_handle); // Ensure the handle itself is passed for output
    }

    @Test
    void constructor_shouldThrowSmbExceptionOnRpcError() throws IOException {
        // Arrange