#### Bucket quota management permissions

- admin:SetBucketQuota
- admin:GetBucketQuota

#### Bucket target management permissions

- admin:SetBucketTarget
- admin:GetBucketTarget

#### Remote tier management permissions

- admin:SetTier
- admin:ListTier

#### Give full admin permissions

- admin:*

### 5. Using an external IDP for admin users

	// such that finally fivs.Versions has
	// all the non-free versions and fivs.FreeVersions has all the free
	// versions.
	n := 0
	for _, fi := range fivs.Versions {
		// filter our tier object delete marker
		if fi.TierFreeVersion() {
			if !inclFreeVersions {
				fivs.FreeVersions = append(fivs.FreeVersions, fi)
			}
		} else {
			if !inclFreeVersions {
				fivs.Versions[n] = fi
			}
			n++

}

func stsLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "sts", err, errKind...)
}

func tierLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "tier", err, errKind...)
}

func kmsLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "kms", err, errKind...)
}

// KMSLogger permits access to kms module specific logging

	}

	return tags.ParseObjectTags(oi.UserTags)
}

// TransitionObject - transition object content to target tier.
func (er erasureObjects) TransitionObject(ctx context.Context, bucket, object string, opts ObjectOptions) error {
	tgtClient, err := globalTierConfigMgr.getDriver(ctx, opts.Transition.Tier)
	if err != nil {
		return err
	}

	if !opts.NoLock {

			z.VersionID, bts, err = msgp.ReadStringBytes(bts)
			if err != nil {
				err = msgp.WrapError(err, "VersionID")
				return
			}
		case "Tier":
			z.Tier, bts, err = msgp.ReadStringBytes(bts)
			if err != nil {
				err = msgp.WrapError(err, "Tier")
				return
			}
		case "FreeVersion":
			z.FreeVersion, bts, err = msgp.ReadBoolBytes(bts)
			if err != nil {

		if nErr.Err != nil {
			peersLogOnceIf(logger.SetReqInfo(ctx, reqInfo), nErr.Err, nErr.Host.String())
		}
	}
}

// LoadTransitionTierConfig notifies remote peers to load their remote tier
// configs from config store.
func (sys *NotificationSys) LoadTransitionTierConfig(ctx context.Context) {
	ng := WithNPeers(len(sys.peerClients))
	for idx, client := range sys.peerClients {
		if client == nil {

		Help:      "Total bytes transitioned to a tier",
		Type:      gaugeMetric,
	}
}

func getClusterTransitionedObjectsMD() MetricDescription {
	return MetricDescription{
		Namespace: clusterMetricNamespace,
		Subsystem: ilmSubsystem,
		Name:      transitionedObjects,
		Help:      "Total number of objects transitioned to a tier",
		Type:      gaugeMetric,
	}
}

type ExpirationOptions struct {
	Expire bool
}

// TransitionOptions represents object options for transition ObjectLayer operation
type TransitionOptions struct {
	Status         string
	Tier           string
	ETag           string
	RestoreRequest *RestoreObjectRequest
	RestoreExpiry  time.Time
	ExpireRestored bool
}

// MakeBucketOptions represents bucket options for ObjectLayer bucket operations

      "x-minio-internal-replication-timestamp": "MjAyMS0wOS0xN1QwMTo0MzozOC40MDQwMDA0ODNa",
      "x-minio-internal-tier-free-versionID": "OWZlZjk5N2QtMjMzZi00N2U3LTlkZmMtNWYxNzc3NzdlZTM2"
    },
    "MetaUsr": {
      "X-Amz-Replication-Status": "COMPLETED",
      "content-type": "application/octet-stream",

		globalBucketVersioningSys = NewBucketVersioningSys()
	}

	// Create new bucket replication subsystem
	globalBucketTargetSys = NewBucketTargetSys(GlobalContext)

	// Create new ILM tier configuration subsystem
	globalTierConfigMgr = NewTierConfigMgr()

	globalTransitionState = newTransitionState(GlobalContext)
	globalSiteResyncMetrics = newSiteResyncMetrics(GlobalContext)
}