```sh
cat > example.rego <<EOF
package httpapi.authz

import input

default allow = false

# Allow the root user to perform any action.
allow {
 input.owner == true
}

# All other users may do anything other than call PutObject
allow {
 input.action != "s3:PutObject"
 input.owner == false
}
EOF
```

Then load the policy via OPA's REST API.

```
curl -X PUT --data-binary @example.rego \

	bucket := vars["bucket"]

	objAPI := api.ObjectAPI()
	if objAPI == nil {
		writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrServerNotInitialized), r.URL)
		return
	}

	// Allow GetBucketWebsite if policy action is set, since this is a dummy call
	// we are simply re-purposing the bucketPolicyAction.
	if s3Error := checkRequestAuthType(ctx, r, policy.GetBucketPolicyAction, bucket, ""); s3Error != ErrNone {

        - 'https://server1-pool2:9000/mnt/disk{1...4}/'
        - 'https://server3-pool2:9000/mnt/disk{1...4}/'
        - 'https://server4-pool2:9000/mnt/disk{1...4}/'

options:
  ftp: # settings for MinIO to act as an ftp server
        address: ':8021'
        passive-port-range: '30000-40000'
  sftp: # settings for MinIO to act as an sftp server
        address: ':8022'

import subprocess

from playwright.sync_api import Playwright, sync_playwright


# Run playwright codegen to generate the code below, copy paste the sections in run()
def run(playwright: Playwright) -> None:
    browser = playwright.chromium.launch(headless=False)
    # Update the viewport manually
    context = browser.new_context(viewport={"width": 960, "height": 1080})
    page = context.new_page()
    page.goto("http://localhost:8000/docs")

        - 'https://server1-pool2:9000/mnt/disk{1...4}/'
        - 'https://server3-pool2:9000/mnt/disk{1...4}/'
        - 'https://server4-pool2:9000/mnt/disk{1...4}/'

options:
  ftp: # settings for MinIO to act as an ftp server
        address: ':8021'
        passive-port-range: '30000-40000'
  sftp: # settings for MinIO to act as an sftp server
        address: ':8022'

# Apache Maven Upgrade Script
#
# Environment Variable Prerequisites
#
#   JAVA_HOME           (Optional) Points to a Java installation.
#   MAVEN_OPTS          (Optional) Java runtime options used when Maven is executed.
#   MAVEN_SKIP_RC       (Optional) Flag to disable loading of mavenrc files.
# -----------------------------------------------------------------------------

        - 'https://server1-pool2:9000/mnt/disk{1...4}/'
        - 'https://server3-pool2:9000/mnt/disk{1...4}/'
        - 'https://server4-pool2:9000/mnt/disk{1...4}/'

options:
  ftp: # settings for MinIO to act as an ftp server
        address: ':8021'
        passive-port-range: '30000-40000'
  sftp: # settings for MinIO to act as an sftp server
        address: ':8022'

@REM   MAVEN_BATCH_ECHO    (Optional) Set to 'on' to enable the echoing of the batch commands.
@REM   MAVEN_BATCH_PAUSE   (Optional) set to 'on' to wait for a key stroke before ending.
@REM   MAVEN_OPTS          (Optional) Java runtime options used when Maven is executed.
@REM   MAVEN_SKIP_RC       (Optional) Flag to disable loading of mavenrc files.
@REM -----------------------------------------------------------------------------

browser at `http://localhost:8080`, and its JavaScript is trying to communicate with a backend running at `http://localhost` (because we don't specify a port, the browser will assume the default port `80`).

Then, the browser will send an HTTP `OPTIONS` request to the `:80`-backend, and if the backend sends the appropriate headers authorizing the communication from this different origin (`http://localhost:8080`) then the `:8080`-browser will let the JavaScript in the frontend send its request to...

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": [
        "arn:aws:s3:::${ldap:username}/*"
      ]
    }
  ]