#### Bucket quota management permissions

- admin:SetBucketQuota
- admin:GetBucketQuota

#### Bucket target management permissions

- admin:SetBucketTarget
- admin:GetBucketTarget

#### Remote tier management permissions

- admin:SetTier
- admin:ListTier

#### Give full admin permissions

- admin:*

### 5. Using an external IDP for admin users

		// https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html#API_HeadObject_ResponseSyntax
		w.Header()[xhttp.AmzStorageClass] = []string{filterStorageClass(ctx, objInfo.TransitionedObject.Tier)}
	}

	if lc, err := globalLifecycleSys.Get(objInfo.Bucket); err == nil {
		lc.SetPredictionHeaders(w, objInfo.ToLifecycleOpts())
	}

	if v, ok := objInfo.UserDefined[ReservedMetadataPrefix+"compression"]; ok {

// selector matches the node in question and has free CIDRs to allocate.  In
// case of multiple matching ClusterCIDR resources, the allocator will attempt
// to break ties using internal heuristics, but any ClusterCIDR whose node
// selector matches the Node may be used.
message ClusterCIDR {
  // Standard object's metadata.

      factory.setAccessible(true);
    }
    // Sorts methods/constructors with the least number of parameters first since it's likely easier
    // to fill dummy parameter values for them. Ties are broken by name then by the string form of
    // the parameter list.
    return BY_NUMBER_OF_PARAMETERS
        .compound(BY_METHOD_NAME)
        .compound(BY_PARAMETERS)
        .immutableSortedCopy(factories);

	// such that finally fivs.Versions has
	// all the non-free versions and fivs.FreeVersions has all the free
	// versions.
	n := 0
	for _, fi := range fivs.Versions {
		// filter our tier object delete marker
		if fi.TierFreeVersion() {
			if !inclFreeVersions {
				fivs.FreeVersions = append(fivs.FreeVersions, fi)
			}
		} else {
			if !inclFreeVersions {
				fivs.Versions[n] = fi
			}
			n++

}

// GenerateKey generates a new data encryption key using
// the key at the KES server referenced by the key ID.
//
// The default key ID will be used if keyID is empty.
//
// The context is associated and tied to the generated DEK.
// The same context must be provided when the generated
// key should be decrypted.
func (c *kesConn) GenerateKey(ctx context.Context, req *GenerateKeyRequest) (DEK, error) {

	// key referenced by the key ID.
	//
	// The KMS may use a default key if the key ID is empty.
	// GenerateKey returns an error if the referenced key does
	// not exist.
	//
	// The context is associated and tied to the generated DEK.
	// The same context must be provided when the generated key
	// should be decrypted. Therefore, it is the callers
	// responsibility to remember the corresponding context for

`IstioOperatorSpec` defines functional settings at the feature level. Functional settings are those that performs some
function in the Istio control plane without necessarily being tied to any one component that runs in a Deployment.
Component settings are those that necessarily refer to a particular Deployment or Service. For example, the number

}

func stsLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "sts", err, errKind...)
}

func tierLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "tier", err, errKind...)
}

func kmsLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "kms", err, errKind...)
}

// KMSLogger permits access to kms module specific logging

	}

	return tags.ParseObjectTags(oi.UserTags)
}

// TransitionObject - transition object content to target tier.
func (er erasureObjects) TransitionObject(ctx context.Context, bucket, object string, opts ObjectOptions) error {
	tgtClient, err := globalTierConfigMgr.getDriver(ctx, opts.Transition.Tier)
	if err != nil {
		return err
	}

	if !opts.NoLock {