allow {
 input.owner == true
}

# All other users may do anything other than call PutObject
allow {
 input.action != "s3:PutObject"
 input.owner == false
}
EOF
```

Then load the policy via OPA's REST API.

```
curl -X PUT --data-binary @example.rego \
  localhost:8181/v1/policies/putobject
```

### 4. Setup MinIO with OPA

     * Creates a new duplicate host helper instance.
     */
    public DuplicateHostHelper() {
        // Default constructor
    }

    /**
     * Initializes the duplicate host helper after construction.
     * Loads duplicate host configurations from the DuplicateHostService.
     */
    @PostConstruct
    public void init() {
        if (logger.isDebugEnabled()) {

        File pom0 = new File(localRepo, "p0/pom.xml");

        File pom0Basedir = pom0.getParentFile();

        File pom1 = new File(pom0Basedir, "p1/pom.xml");

        // load everything...
        MavenProject project0 = getProjectWithDependencies(pom0);
        MavenProject project1 = getProjectWithDependencies(pom1);

        assertEquals(pom0Basedir, project1.getParent().getBasedir());

## Prometheus Probe

MinIO allows reading metrics for the entire cluster from any single node. This allows for metrics collection for a MinIO instance across all servers. Thus, metrics collection for instances behind a load balancer can be done without any knowledge of the individual node addresses. The cluster wide metrics can be read at
`<Address for MinIO Service>/minio/v2/metrics/cluster`.

        allow_redirects=False, auth=(client_id, client_secret))

    print('body: ' + id_token_response.text)

    # we can now use the id_token as much as we want to access protected resources.
    tokens = json.loads(id_token_response.text)
    id_token = tokens['id_token']

    response = sts_client.assume_role_with_web_identity(
        RoleArn='arn:aws:iam::123456789012:user/svc-internal-api',
        RoleSessionName='test',

            from(files(basePath.file("build.versions.toml")))
        }
        val sharedVersions = basePath.file("shared-versions.properties").asFile.inputStream().use {
            Properties().apply { load(it) }
        }
        all {
            sharedVersions.forEach { key, value ->
                version(key.toString(), value.toString())
            }
        }
    }

  command: server http://minio{1...4}/data{1...3}
  env_file:
    - ./minio.env
  expose:
    - "9000"
    - "9001"

# starts 4 docker containers running minio server instances.
# using nginx reverse proxy, load balancing, you can access
# it through port 9000.
services:
  minio1:
    <<: *minio-common
    hostname: minio1
    volumes:
      - data1-1:/data1
      - data1-2:/data2
      - data1-3:/data3

    private static final Logger logger = LogManager.getLogger(LoadControlMonitorTarget.class);

    private final SystemHelper systemHelper;

    private int consecutiveFailures = 0;

    /**
     * Constructs a new load control monitor target.
     *
     * @param systemHelper the system helper to update with CPU usage
     */
    public LoadControlMonitorTarget(final SystemHelper systemHelper) {
        this.systemHelper = systemHelper;

            setFeature("http://xml.org/sax/features/external-parameter-entities", false)
            setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false)
            isExpandEntityReferences = false
            setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)
            setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "")

        File pom0 = new File(localRepo, "p0/pom.xml");

        File pom0Basedir = pom0.getParentFile();

        File pom1 = new File(pom0Basedir, "p1/pom.xml");

        // load everything...
        MavenProject project0 = getProjectWithDependencies(pom0);
        MavenProject project1 = getProjectWithDependencies(pom1);

        assertEquals(pom0Basedir, project1.getParent().getBasedir());