Partition:    "minio",
				Service:      "iam",
				Region:       "us-east-1",
				ResourceType: "role",
				ResourceID:   "my-role",
			},
			wantErr: false,
		},
		{
			name: "valid resource ID must succeed",
			args: args{
				resourceID:   "-my-role",
				serverRegion: "us-east-1",
			},
			want: ARN{
				Partition:    "minio",
				Service:      "iam",
				Region:       "us-east-1",

		// Export IAM info to zipped file
		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/export-iam").HandlerFunc(adminMiddleware(adminAPI.ExportIAM, noGZFlag))

		// Import IAM info
		adminRouter.Methods(http.MethodPut).Path(adminVersion + "/import-iam").HandlerFunc(adminMiddleware(adminAPI.ImportIAM, noGZFlag))

U,GAGVnB,EAAIwG,EAAUA,EAAQqc,QAAQ,GAAGnnB,QAAQ,SAAU,IAAM,GAEzD8mB,EAAYI,EAAQ,EAAI,IAAM,GAC9BH,EAAStP,GAAK7gB,KAAKogB,WAAaS,GAAKyP,GAAS,IAAM,GACpDF,EAAWvP,GAAK7gB,KAAKmgB,SAAWU,GAAKyP,GAAS,IAAM,GACpDD,EAAUxP,GAAK7gB,KAAKkgB,iBAAmBW,GAAKyP,GAAS,IAAM,GAGvDJ,EACA,KACC1Q,EAAQ2Q,EAAS3Q,EAAQ,IAAM,KAC/B3Q,EAASshB,EAASthB,EAAS,IAAM,KACjCgR,EAAOuQ,EAAWvQ,EAAO,IAAM,KAC/BhM,GAASE,GAAWG,EAAU,IAAM,KACpCL,EAAQwc,EAAUxc,EAAQ,IAAM,KAChCE,EAAUsc,EAAUtc,EAAU,IAAM,KACpCG,EAAUmc,EAAU3iB,EAAI,IAAM,KA9BxB,MAkCf,IAAI8i...

## Specifying Access Control with IAM Policies

OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

### 1. Start OPA in a container

```sh
podman run -it \
    --name opa \
    --publish 8181:8181 \

CJiR,EAAYtG,GAAQ,GACpBiL,EAAa,GACbC,EAAgBxO,EAGhBrF,EAAQ2I,GAAQ6K,GAAapO,EAAKsD,KAAK3B,IAAK,IAAK2M,GAGjDI,EAAkBpO,GAA4B,MAAjBmO,EAAwB,EAAI7R,KAAKC,UAAY,GAC1ElB,EAAMf,EAAMZ,OAeb,IAbKsU,IAMJrO,EAAmBrG,GAAWvD,GAAYuD,GAAW0U,GAO9C1V,IAAM+C,GAAgC,OAAvBzB,EAAOU,EAAOhC,IAAeA,IAAM,CACzD,GAAKwV,GAAalU,EAAO,CACxB0B,EAAI,EAMEhC,GAAWM,EAAK+D,eAAiB5H,IACtCwM,EAAa3I,GACb0O,GAAOxI,GAER,MAAUuJ,EAAUsE,EAAiBrS,KACpC,GAAK+N,EAASzP,EAAMN,GAAWvD,EAAUuS,GAAQ,CAChDvR,EAAKH,KAAMyG,EAASzD,GACpB,MAGGoU,IACJhO,EAAUoO,GAKPP...

pid=$!

mc ready myminio

mc admin user add myminio/ minio123 minio123

mc admin policy create myminio/ deny-non-sse-kms-pol ./docs/iam/policies/deny-non-sse-kms-objects.json
mc admin policy create myminio/ deny-invalid-sse-kms-pol ./docs/iam/policies/deny-objects-with-invalid-sse-kms-key-id.json

mc admin policy attach myminio deny-non-sse-kms-pol --user minio123

		return nil, errors.New("no bucket name was provided")
	}

	// Credentials initialization
	var creds *credentials.Credentials
	switch {
	case conf.AWSRole:
		creds = credentials.New(&credentials.IAM{
			Client: &http.Client{
				Transport: NewHTTPTransport(),
			},
		})
	case conf.AWSRoleWebIdentityTokenFile != "" && conf.AWSRoleARN != "":
		sessionName := conf.AWSRoleSessionName
		if sessionName == "" {

	logger.LogOnceIf(ctx, "iam", err, id, errKind...)
}

func iamLogIf(ctx context.Context, err error, errKind ...interface{}) {
	if !errors.Is(err, grid.ErrDisconnected) {
		logger.LogIf(ctx, "iam", err, errKind...)
	}
}

func iamLogEvent(ctx context.Context, msg string, args ...interface{}) {
	logger.Event(ctx, "iam", msg, args...)
}

| `/cluster/config`        | Cluster configuration metrics. |
| `/cluster/erasure-set`   | Erasure set metrics.           |
| `/cluster/health`        | Cluster health metrics.        |
| `/cluster/iam`           | Cluster iam metrics.           |
| `/cluster/usage/buckets` | Object statistics by bucket.   |
| `/cluster/usage/objects` | Object statistics.             |

#### `/cluster/config`