- The user can now use these credentials to make requests to the MinIO server.

The administrator will associate IAM access policies with each group and if required with the user too. The MinIO server then evaluates applicable policies on a user (these are the policies associated with the groups along with the policy on the user if any) to check if the request should be allowed or denied.

				if policy.IsEmpty() {
					err = globalIAMSys.DeletePolicy(ctx, policyName, true)
					removed.Policies = append(removed.Policies, policyName)
				} else {
					_, err = globalIAMSys.SetPolicy(ctx, policyName, policy)
					added.Policies = append(added.Policies, policyName)
				}
				if err != nil {
					writeErrorResponseJSON(ctx, w, importError(ctx, err, allPoliciesFile, policyName), r.URL)

Use [`mc admin policy`](https://min.io/docs/minio/linux/reference/minio-mc-admin/mc-admin-policy.html) to create canned policies. Server provides a default set of canned policies namely `writeonly`, `readonly` and `readwrite` *(these policies apply to all resources on the server)*. These can be overridden by custom policies using `mc admin policy` command.

    {{- include (print $.Template.BasePath "/_helper_create_user.txt") . | nindent 4 }}
  add-policy: |-
    {{- include (print $.Template.BasePath "/_helper_create_policy.txt") . | nindent 4 }}
  {{- range $idx, $policy := .Values.policies }}
  # Policy: {{ $policy.name }}
  policy_{{ $idx }}.json: |-
    {{- include (print $.Template.BasePath "/_helper_policy.tpl") . | nindent 4 }}
  {{ end }}
  {{- range $idx, $svc := .Values.svcaccts }}

	err := s.adm.SetUser(ctx, accessKey, secretKey, madmin.AccountEnabled)
	if err != nil {
		c.Fatalf("Unable to set user: %v", err)
	}

	userReq := madmin.PolicyAssociationReq{
		Policies: []string{"readwrite"},
		User:     accessKey,
	}
	if _, err := s.adm.AttachPolicy(ctx, userReq); err != nil {
		c.Fatalf("Unable to attach policy: %v", err)
	}

`buckets[].policy` - can be one of none|download|upload|public - `buckets[].purge` - purge if bucket exists already 33# Create policies after install Install the chart, specifying the policies you want to create after install: ```bash helm install --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' minio/minio ``` Description of the configuration parameters used above...

`buckets[].policy` - can be one of none|download|upload|public - `buckets[].purge` - purge if bucket exists already 33# Create policies after install Install the chart, specifying the policies you want to create after install: ```bash helm install --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' minio/minio ``` Description of the configuration parameters used above...

`buckets[].policy` - can be one of none|download|upload|public - `buckets[].purge` - purge if bucket exists already 33# Create policies after install Install the chart, specifying the policies you want to create after install: ```bash helm install --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' minio/minio ``` Description of the configuration parameters used above...

pid=$!

mc ready myminio

mc admin user add myminio/ minio123 minio123

mc admin policy create myminio/ deny-non-sse-kms-pol ./docs/iam/policies/deny-non-sse-kms-objects.json
mc admin policy create myminio/ deny-invalid-sse-kms-pol ./docs/iam/policies/deny-objects-with-invalid-sse-kms-key-id.json

mc admin policy attach myminio deny-non-sse-kms-pol --user minio123

     * @param id        the unique identifier of the repository
     * @param url       the URL of the repository
     * @param layout    the layout of the repository
     * @param snapshots the policies to use for snapshots
     * @param releases  the policies to use for releases
     */
    public DefaultArtifactRepository(
            String id,
            String url,
            ArtifactRepositoryLayout layout,