"Statement": [
    {
      "Action": [
        "admin:CreateUser",
        "admin:DeleteUser",
        "admin:ConfigUpdate"
      ],
      "Effect": "Allow",
      "Sid": ""
    },
    {
      "Action": [
        "s3:*"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::*"
      ],
      "Sid": ""
    }
  ]
}
EOF
```

  # These settings that determine how long an old Envoy
  # process should be kept alive after an occasional reload.
  drainDuration: 2s
  #
  # The mode used to redirect inbound connections to Envoy. This setting
  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.

    }

    public static void setLevel( int level ) {
        LogStream.level = level;
    }
    /**
     * This must be called before <tt>getInstance</tt> is called or
     * it will have no effect.
     */
    public static void setInstance( PrintStream stream ) {
        inst = new LogStream( stream );
    }
    public static LogStream getInstance() {
        if( inst == null ) {

	return []miniogopolicy.Statement{
		{
			Effect:    string(policy.Allow),
			Principal: miniogopolicy.User{AWS: set.CreateStringSet("*")},
			Resources: set.CreateStringSet(policy.NewResource(bucketName).String()),
			Actions:   set.CreateStringSet("s3:GetBucketLocation", "s3:ListBucket"),
		},
		{
			Effect:    string(policy.Allow),
			Principal: miniogopolicy.User{AWS: set.CreateStringSet("*")},

   *
   * <p>If {@code edge} already connects {@code nodeU} to {@code nodeV} (in the specified order if
   * this network {@link #isDirected()}, else in any order), then this method will have no effect.
   *
   * @return {@code true} if the network was modified as a result of this call
   * @throws IllegalArgumentException if {@code edge} already exists in the graph and does not
   *     connect {@code nodeU} to {@code nodeV}

	bucketPolicyTemplate := `{"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetBucketLocation","s3:ListBucket"],"Resource":["arn:aws:s3:::%s"]},{"Sid":"","Effect":"Allow","Principal":{"AWS":["*"]},"Action":["s3:GetObject"],"Resource":["arn:aws:s3:::%s/this*"]}]}`

```
{
 "Version": "2012-10-17",
 "Statement": [
  {
    "Action": [
        "admin:SetBucketTarget",
        "admin:GetBucketTarget"
    ],
    "Effect": "Allow",
    "Sid": ""
  },
  {
   "Effect": "Allow",
   "Action": [
    "s3:GetReplicationConfiguration",
    "s3:PutReplicationConfiguration",
    "s3:ListBucket",
    "s3:ListBucketMultipartUploads",
    "s3:GetBucketLocation",

var errNoSuchGroup = errors.New("Specified group does not exist")

// error returned in IAM subsystem when a policy attach/detach request has no
// net effect, i.e. it is already applied.
var errNoPolicyToAttachOrDetach = errors.New("Specified policy update has no net effect")

// error returned in IAM subsystem when a non-empty group needs to be
// deleted.
var errGroupNotEmpty = errors.New("Specified group is not empty - cannot remove it")

/**
 * Implementation of {@link Multimap} using hash tables.
 *
 * <p>The multimap does not store duplicate key-value pairs. Adding a new key-value pair equal to an
 * existing key-value pair has no effect.
 *
 * <p>Keys and values may be null. All optional multimap methods are supported, and all returned
 * views are modifiable.
 *

        /* Note there's a signedness error here because 0xC0000000 based values are
         * negative so it with NT_STATUS_SUCCESS (0) the binary search will not be
         * performed properly. The effect is that the code at index 1 is never found
         * (NT_STATUS_UNSUCCESSFUL). So here we factor out NT_STATUS_SUCCESS
         * as a special case (which it is).
         */
        if (errcode == 0) {