After configuring the plugin, use the generated Role ARN with `AssumeRoleWithCustomToken` to get temporary credentials to access object storage.

## API Request

To make an STS API request with this method, send a POST request to the MinIO endpoint with following query parameters:

		switch {
		case e.Substring.From != nil:
			result.combine(e.Substring.From.analyze(s))
			if e.Substring.For != nil {
				result.combine(e.Substring.Expr.analyze(s))
			}
		case e.Substring.Arg2 != nil:
			result.combine(e.Substring.Arg2.analyze(s))
			if e.Substring.Arg3 != nil {
				result.combine(e.Substring.Arg3.analyze(s))
			}
		default:
			result.err = errVal
		}
		return result

	case sqlFnUTCNow:

<div class="row">
	<div class="col-sm-2">
		<la:message key="labels.pagination_page_guide_msg"
			arg0="${f:h(pager.currentPageNumber)}"
			arg1="${f:h(pager.allPageCount)}"
			arg2="${f:h(pager.allRecordCount)}" />
	</div>
	<nav aria-label="...">
	</nav>
	<div class="col-sm-10">
		<ul class="pagination pagination-sm m-0 float-right">
			<c:if test="${pager.existPrePage}">

MINIO_IDENTITY_PLUGIN_ROLE_ID       (string)    unique ID to generate the ARN
MINIO_IDENTITY_PLUGIN_COMMENT       (sentence)  optionally add a comment to this setting
```

If provided, the auth token parameter is sent as an authorization header.

`MINIO_IDENTITY_PLUGIN_ROLE_POLICY` is a required parameter and can be list of comma separated policy names.

variables in the *Resource* element and in string comparisons in the *Condition* element.

You can use a policy variable in the Resource element, but only in the resource portion of the ARN. This portion of the ARN appears after the 5th colon (:). You can't use a variable to replace parts of the ARN before the 5th colon, such as the service or account. The following policy might be attached to a group. It gives each of the users in the group full programmatic access to a user-specific object...

		return nil, errIncorrectSQLFunctionArgumentType(err)
	}

	// Assemble other arguments
	arg2, arg3 := e.From, e.For
	// Check if the second form of substring is being used
	if e.From == nil {
		arg2, arg3 = e.Arg2, e.Arg3
	}

	// Evaluate the FROM argument
	v2, err := arg2.evalNode(r, tableAlias)
	if err != nil {
		return nil, err
	}
	inferTypeForArithOp(v2)

	PrincipalID string `json:"principalId"`
}

// Bucket represents bucket metadata of the event.
type Bucket struct {
	Name          string   `json:"name"`
	OwnerIdentity Identity `json:"ownerIdentity"`
	ARN           string   `json:"arn"`
}

// Object represents object metadata of the event.
type Object struct {
	Key          string            `json:"key"`
	Size         int64             `json:"size,omitempty"`

                                                    arg0="${f:h(pager.currentPageNumber)}"
                                                    arg1="${f:h(pager.allPageCount)}"
                                                    arg2="${f:h(pager.allRecordCount)}"/>
                                    </div>
                                    <div class="col-sm-10">
                                        <ul class="pagination pagination-sm m-0 float-right">

   *
   * <p>For example:
   *
   * <pre>{@code
   * Streams.zip(
   *   Stream.of("foo1", "foo2", "foo3"),
   *   Stream.of("bar1", "bar2"),
   *   (arg1, arg2) -> arg1 + ":" + arg2)
   * }</pre>
   *
   * <p>will return {@code Stream.of("foo1:bar1", "foo2:bar2")}.
   *
   * <p>The resulting stream will only be as long as the shorter of the two input streams; if one

					arg0="${displayQuery}" arg1="${fe:formatNumber(allRecordCount,'###,###')}"
					arg2="${f:h(currentStartRecordNumber)}"
					arg3="${f:h(currentEndRecordNumber)}" />
			</c:if><c:if test="${allRecordCountRelation!='EQUAL_TO'}">
				<la:message key="labels.search_result_status_over"
					arg0="${displayQuery}" arg1="${fe:formatNumber(allRecordCount,'###,###')}"
					arg2="${f:h(currentStartRecordNumber)}"
					arg3="${f:h(currentEndRecordNumber)}" />