policy

const (
	// AbortMultipartUploadAction - AbortMultipartUpload Rest API action.
	AbortMultipartUploadAction Action = "s3:AbortMultipartUpload"

	// CreateBucketAction - CreateBucket Rest API action.
	CreateBucketAction Action = "s3:CreateBucket"

	// DeleteBucketAction - DeleteBucket Rest API action.
	DeleteBucketAction Action = "s3:DeleteBucket"

	// ForceDeleteBucketAction - DeleteBucket Rest API action when x-minio-force-delete flag
	// is specified.
	ForceDeleteBucketAction Action = "s3:ForceDeleteBucket"

	// DeleteBucketPolicyAction - DeleteBucketPolicy Rest API action.
	DeleteBucketPolicyAction Action = "s3:DeleteBucketPolicy"

	// DeleteBucketCorsAction - DeleteBucketCors Rest API action.
	DeleteBucketCorsAction Action = "s3:DeleteBucketCors"

	// DeleteObjectAction - DeleteObject Rest API action.
	DeleteObjectAction Action = "s3:DeleteObject"

	// GetBucketLocationAction - GetBucketLocation Rest API action.
	GetBucketLocationAction Action = "s3:GetBucketLocation"

	// GetBucketNotificationAction - GetBucketNotification Rest API action.
	GetBucketNotificationAction Action = "s3:GetBucketNotification"

	// GetBucketPolicyAction - GetBucketPolicy Rest API action.
	GetBucketPolicyAction Action = "s3:GetBucketPolicy"

	// GetBucketCorsAction - GetBucketCors Rest API action.
	GetBucketCorsAction Action = "s3:GetBucketCors"

	// GetObjectAction - GetObject Rest API action.
	GetObjectAction Action = "s3:GetObject"

	// GetObjectAttributesAction - GetObjectVersionAttributes Rest API action.
	GetObjectAttributesAction Action = "s3:GetObjectAttributes"

	// HeadBucketAction - HeadBucket Rest API action. This action is unused in minio.
	HeadBucketAction Action = "s3:HeadBucket"

	// ListAllMyBucketsAction - ListAllMyBuckets (List buckets) Rest API action.
	ListAllMyBucketsAction Action = "s3:ListAllMyBuckets"

	// ListBucketAction - ListBucket Rest API action.
	ListBucketAction Action = "s3:ListBucket"

	// GetBucketPolicyStatusAction - Retrieves the policy status for a bucket.
	GetBucketPolicyStatusAction Action = "s3:GetBucketPolicyStatus"

	// ListBucketVersionsAction - ListBucketVersions Rest API action.
	ListBucketVersionsAction Action = "s3:ListBucketVersions"

	// ListBucketMultipartUploadsAction - ListMultipartUploads Rest API action.
	ListBucketMultipartUploadsAction Action = "s3:ListBucketMultipartUploads"

	// ListenNotificationAction - ListenNotification Rest API action.
	// This is MinIO extension.
	ListenNotificationAction Action = "s3:ListenNotification"

	// ListenBucketNotificationAction - ListenBucketNotification Rest API action.
	// This is MinIO extension.
	ListenBucketNotificationAction Action = "s3:ListenBucketNotification"

	// ListMultipartUploadPartsAction - ListParts Rest API action.
	ListMultipartUploadPartsAction Action = "s3:ListMultipartUploadParts"

	// PutBucketLifecycleAction - PutBucketLifecycle Rest API action.
	PutBucketLifecycleAction Action = "s3:PutLifecycleConfiguration"

	// GetBucketLifecycleAction - GetBucketLifecycle Rest API action.
	GetBucketLifecycleAction Action = "s3:GetLifecycleConfiguration"

	// PutBucketNotificationAction - PutObjectNotification Rest API action.
	PutBucketNotificationAction Action = "s3:PutBucketNotification"

	// PutBucketPolicyAction - PutBucketPolicy Rest API action.
	PutBucketPolicyAction Action = "s3:PutBucketPolicy"

	// PutBucketCorsAction - PutBucketCors Rest API action.
	PutBucketCorsAction Action = "s3:PutBucketCors"

	//  PutBucketQOSAction - allow set QOS configuration
	PutBucketQOSAction Action = "s3:PutBucketQOS"

	//  GetBucketQOSAction - allow get QOS configuration
	GetBucketQOSAction Action = "s3:GetBucketQOS"

	// PutObjectAction - PutObject Rest API action.
	PutObjectAction Action = "s3:PutObject"

	// DeleteObjectVersionAction - DeleteObjectVersion Rest API action.
	DeleteObjectVersionAction Action = "s3:DeleteObjectVersion"

	// DeleteObjectVersionTaggingAction - DeleteObjectVersionTagging Rest API action.
	DeleteObjectVersionTaggingAction Action = "s3:DeleteObjectVersionTagging"

	// GetObjectVersionAction - GetObjectVersionAction Rest API action.
	GetObjectVersionAction Action = "s3:GetObjectVersion"

	// GetObjectVersionAttributesAction - GetObjectVersionAttributes Rest API action.
	GetObjectVersionAttributesAction Action = "s3:GetObjectVersionAttributes"

	// GetObjectVersionTaggingAction - GetObjectVersionTagging Rest API action.
	GetObjectVersionTaggingAction Action = "s3:GetObjectVersionTagging"

	// PutObjectVersionTaggingAction - PutObjectVersionTagging Rest API action.
	PutObjectVersionTaggingAction Action = "s3:PutObjectVersionTagging"

	// BypassGovernanceRetentionAction - bypass governance retention for PutObjectRetention, PutObject and DeleteObject Rest API action.
	BypassGovernanceRetentionAction Action = "s3:BypassGovernanceRetention"

	// PutObjectRetentionAction - PutObjectRetention Rest API action.
	PutObjectRetentionAction Action = "s3:PutObjectRetention"

	// GetObjectRetentionAction - GetObjectRetention, GetObject, HeadObject Rest API action.
	GetObjectRetentionAction Action = "s3:GetObjectRetention"

	// GetObjectLegalHoldAction - GetObjectLegalHold, GetObject Rest API action.
	GetObjectLegalHoldAction Action = "s3:GetObjectLegalHold"

	// PutObjectLegalHoldAction - PutObjectLegalHold, PutObject Rest API action.
	PutObjectLegalHoldAction Action = "s3:PutObjectLegalHold"

	// GetBucketObjectLockConfigurationAction - GetBucketObjectLockConfiguration Rest API action
	GetBucketObjectLockConfigurationAction Action = "s3:GetBucketObjectLockConfiguration"

	// PutBucketObjectLockConfigurationAction - PutBucketObjectLockConfiguration Rest API action
	PutBucketObjectLockConfigurationAction Action = "s3:PutBucketObjectLockConfiguration"

	// GetBucketTaggingAction - GetBucketTagging Rest API action
	GetBucketTaggingAction Action = "s3:GetBucketTagging"

	// PutBucketTaggingAction - PutBucketTagging Rest API action
	PutBucketTaggingAction Action = "s3:PutBucketTagging"

	// GetObjectTaggingAction - Get Object Tags API action
	GetObjectTaggingAction Action = "s3:GetObjectTagging"

	// PutObjectTaggingAction - Put Object Tags API action
	PutObjectTaggingAction Action = "s3:PutObjectTagging"

	// DeleteObjectTaggingAction - Delete Object Tags API action
	DeleteObjectTaggingAction Action = "s3:DeleteObjectTagging"

	// PutObjectAnnotationAction - PutObjectAnnotation API action
	PutObjectAnnotationAction Action = "s3:PutObjectAnnotation"

	// GetObjectAnnotationAction - GetObjectAnnotation API action
	GetObjectAnnotationAction Action = "s3:GetObjectAnnotation"

	// DeleteObjectAnnotationAction - DeleteObjectAnnotation API action
	DeleteObjectAnnotationAction Action = "s3:DeleteObjectAnnotation"

	// ListObjectAnnotationsAction - ListObjectAnnotations API action
	ListObjectAnnotationsAction Action = "s3:ListObjectAnnotations"

	// UpdateObjectEncryptionAction - UpdateObjectEncryption REST API action
	UpdateObjectEncryptionAction Action = "s3:UpdateObjectEncryption"

	// PutBucketEncryptionAction - PutBucketEncryption REST API action
	PutBucketEncryptionAction Action = "s3:PutEncryptionConfiguration"

	// GetBucketEncryptionAction - GetBucketEncryption REST API action
	GetBucketEncryptionAction Action = "s3:GetEncryptionConfiguration"

	// PutBucketVersioningAction - PutBucketVersioning REST API action
	PutBucketVersioningAction Action = "s3:PutBucketVersioning"

	// GetBucketVersioningAction - GetBucketVersioning REST API action
	GetBucketVersioningAction Action = "s3:GetBucketVersioning"
	// GetReplicationConfigurationAction  - GetReplicationConfiguration REST API action
	GetReplicationConfigurationAction Action = "s3:GetReplicationConfiguration"
	// PutReplicationConfigurationAction  - PutReplicationConfiguration REST API action
	PutReplicationConfigurationAction Action = "s3:PutReplicationConfiguration"

	// ReplicateObjectAction  - ReplicateObject REST API action
	ReplicateObjectAction Action = "s3:ReplicateObject"

	// ReplicateDeleteAction  - ReplicateDelete REST API action
	ReplicateDeleteAction Action = "s3:ReplicateDelete"

	// ReplicateTagsAction  - ReplicateTags REST API action
	ReplicateTagsAction Action = "s3:ReplicateTags"

	// GetObjectVersionForReplicationAction  - GetObjectVersionForReplication REST API action
	GetObjectVersionForReplicationAction Action = "s3:GetObjectVersionForReplication"

	// ReplicateObjectAnnotationAction - ReplicateObjectAnnotation REST API action
	ReplicateObjectAnnotationAction Action = "s3:ReplicateObjectAnnotation"

	// GetObjectVersionAnnotationForReplicationAction - GetObjectVersionAnnotationForReplication REST API action
	GetObjectVersionAnnotationForReplicationAction Action = "s3:GetObjectVersionAnnotationForReplication"

	// RestoreObjectAction - RestoreObject REST API action
	RestoreObjectAction Action = "s3:RestoreObject"
	// ResetBucketReplicationStateAction - MinIO extension API ResetBucketReplicationState to reset replication state
	// on a bucket
	ResetBucketReplicationStateAction Action = "s3:ResetBucketReplicationState"

	// PutObjectFanOutAction - PutObject like API action but allows PostUpload() fan-out.
	PutObjectFanOutAction Action = "s3:PutObjectFanOut"

	// PutInventoryConfigurationAction - Bucket inventory write operations actions
	PutInventoryConfigurationAction Action = "s3:PutInventoryConfiguration"
	// GetInventoryConfigurationAction - Bucket inventory read operations actions
	GetInventoryConfigurationAction Action = "s3:GetInventoryConfiguration"

	// CreateSessionAction - S3Express REST API action
	CreateSessionAction Action = "s3express:CreateSession"

	// AllActions - all API actions
	AllActions Action = "s3:*"
)

const (
	// HealAdminAction - allows heal command
	HealAdminAction AdminAction = "admin:Heal"

	// DecommissionAdminAction - allows decomissioning of pools
	DecommissionAdminAction AdminAction = "admin:Decommission"

	// RebalanceAdminAction - allows rebalancing of pools
	RebalanceAdminAction AdminAction = "admin:Rebalance"

	// StorageInfoAdminAction - allow listing server info
	StorageInfoAdminAction AdminAction = "admin:StorageInfo"
	// PrometheusAdminAction - prometheus info action
	PrometheusAdminAction AdminAction = "admin:Prometheus"
	// DataUsageInfoAdminAction - allow listing data usage info
	DataUsageInfoAdminAction AdminAction = "admin:DataUsageInfo"
	// ForceUnlockAdminAction - allow force unlocking locks
	ForceUnlockAdminAction AdminAction = "admin:ForceUnlock"
	// TopLocksAdminAction - allow listing top locks
	TopLocksAdminAction AdminAction = "admin:TopLocksInfo"
	// ProfilingAdminAction - allow profiling
	ProfilingAdminAction AdminAction = "admin:Profiling"
	// TraceAdminAction - allow listing server trace
	TraceAdminAction AdminAction = "admin:ServerTrace"
	// ConsoleLogAdminAction - allow listing console logs on terminal
	ConsoleLogAdminAction AdminAction = "admin:ConsoleLog"
	// KMSEnableAdminAction - allow enabling the builtin KMS
	KMSEnableAdminAction AdminAction = "admin:KMSEnable"
	// KMSBackupAdminAction - allow backing up builtin KMS keys
	KMSBackupAdminAction AdminAction = "admin:KMSBackup"
	// KMSRestoreAdminAction - allow restoring builtin KMS keys
	KMSRestoreAdminAction AdminAction = "admin:KMSRestore"
	// KMSCreateKeyAdminAction - allow creating a new KMS master key
	KMSCreateKeyAdminAction AdminAction = "admin:KMSCreateKey"
	// KMSKeyStatusAdminAction - allow getting KMS key status
	KMSKeyStatusAdminAction AdminAction = "admin:KMSKeyStatus"
	// KMSKeyRotateAdminAction - allow rotating KMS keys
	KMSKeyRotateAdminAction AdminAction = "admin:KMSKeyRotate"
	// ServerInfoAdminAction - allow listing server info
	ServerInfoAdminAction AdminAction = "admin:ServerInfo"
	// HealthInfoAdminAction - allow obtaining cluster health information
	HealthInfoAdminAction AdminAction = "admin:OBDInfo"
	// LicenseInfoAdminAction - allow obtaining license information
	LicenseInfoAdminAction AdminAction = "admin:LicenseInfo"
	// BandwidthMonitorAction - allow monitoring bandwidth usage
	BandwidthMonitorAction AdminAction = "admin:BandwidthMonitor"
	// InspectDataAction - allows downloading raw files from backend
	InspectDataAction AdminAction = "admin:InspectData"

	// ServerUpdateAdminAction - allow MinIO binary update
	ServerUpdateAdminAction AdminAction = "admin:ServerUpdate"
	// ServiceRestartAdminAction - allow restart of MinIO service.
	ServiceRestartAdminAction AdminAction = "admin:ServiceRestart"
	// ServiceStopAdminAction - allow stopping MinIO service.
	ServiceStopAdminAction AdminAction = "admin:ServiceStop"
	// ServiceFreezeAdminAction - allow freeze/unfreeze MinIO service.
	ServiceFreezeAdminAction AdminAction = "admin:ServiceFreeze"
	// ServiceCordonAdminAction - allow cordon/uncordon MinIO service.
	ServiceCordonAdminAction AdminAction = "admin:ServiceCordon"

	// ConfigUpdateAdminAction - allow MinIO config management
	ConfigUpdateAdminAction AdminAction = "admin:ConfigUpdate"

	// CreateUserAdminAction - allow creating MinIO user
	CreateUserAdminAction AdminAction = "admin:CreateUser"
	// DeleteUserAdminAction - allow deleting MinIO user
	DeleteUserAdminAction AdminAction = "admin:DeleteUser"
	// ListUsersAdminAction - allow list users permission
	ListUsersAdminAction AdminAction = "admin:ListUsers"
	// EnableUserAdminAction - allow enable user permission
	EnableUserAdminAction AdminAction = "admin:EnableUser"
	// DisableUserAdminAction - allow disable user permission
	DisableUserAdminAction AdminAction = "admin:DisableUser"
	// GetUserAdminAction - allows GET permission on user info
	GetUserAdminAction AdminAction = "admin:GetUser"
	// ChangeMyPasswordAdminAction - allow changing own password
	ChangeMyPasswordAdminAction AdminAction = "admin:ChangeMyPassword"

	// SiteReplicationAddAction - allow adding clusters for site-level replication
	SiteReplicationAddAction AdminAction = "admin:SiteReplicationAdd"
	// SiteReplicationDisableAction - allow disabling a cluster from replication
	SiteReplicationDisableAction AdminAction = "admin:SiteReplicationDisable"
	// SiteReplicationRemoveAction - allow removing a cluster from replication
	SiteReplicationRemoveAction AdminAction = "admin:SiteReplicationRemove"
	// SiteReplicationResyncAction - allow resyncing cluster data to another site
	SiteReplicationResyncAction AdminAction = "admin:SiteReplicationResync"
	// SiteReplicationInfoAction - allow getting site replication info
	SiteReplicationInfoAction AdminAction = "admin:SiteReplicationInfo"
	// SiteReplicationOperationAction - allow performing site replication
	// create/update/delete operations to peers
	SiteReplicationOperationAction AdminAction = "admin:SiteReplicationOperation"

	// TablesReplicationAddAction - allow adding tables replication targets
	TablesReplicationAddAction AdminAction = "admin:TablesReplicationAdd"
	// TablesReplicationRemoveAction - allow removing tables replication targets
	TablesReplicationRemoveAction AdminAction = "admin:TablesReplicationRemove"
	// TablesReplicationInfoAction - allow getting tables replication info/status
	TablesReplicationInfoAction AdminAction = "admin:TablesReplicationInfo"
	// TablesReplicationStartFailoverAction - allow starting tables replication failover
	TablesReplicationStartFailoverAction AdminAction = "admin:TablesReplicationStartFailover"
	// TablesReplicationCatalogAdminAction - allow catalog debugging operations (reset, dump contents)
	TablesReplicationCatalogAdminAction AdminAction = "admin:TablesReplicationCatalogAdmin"

	// CreateServiceAccountAdminAction - allow create a service account for a user
	CreateServiceAccountAdminAction AdminAction = "admin:CreateServiceAccount"
	// UpdateServiceAccountAdminAction - allow updating a service account
	UpdateServiceAccountAdminAction AdminAction = "admin:UpdateServiceAccount"
	// RemoveServiceAccountAdminAction - allow removing a service account
	RemoveServiceAccountAdminAction AdminAction = "admin:RemoveServiceAccount"
	// ListServiceAccountsAdminAction - allow listing service accounts
	ListServiceAccountsAdminAction AdminAction = "admin:ListServiceAccounts"

	// ListTemporaryAccountsAdminAction - allow listing of temporary accounts
	ListTemporaryAccountsAdminAction AdminAction = "admin:ListTemporaryAccounts"

	// AddUserToGroupAdminAction - allow adding user to group permission
	AddUserToGroupAdminAction AdminAction = "admin:AddUserToGroup"
	// RemoveUserFromGroupAdminAction - allow removing user to group permission
	RemoveUserFromGroupAdminAction AdminAction = "admin:RemoveUserFromGroup"
	// GetGroupAdminAction - allow getting group info
	GetGroupAdminAction AdminAction = "admin:GetGroup"
	// ListGroupsAdminAction - allow list groups permission
	ListGroupsAdminAction AdminAction = "admin:ListGroups"
	// EnableGroupAdminAction - allow enable group permission
	EnableGroupAdminAction AdminAction = "admin:EnableGroup"
	// DisableGroupAdminAction - allow disable group permission
	DisableGroupAdminAction AdminAction = "admin:DisableGroup"

	// CreatePolicyAdminAction - allow create policy permission
	CreatePolicyAdminAction AdminAction = "admin:CreatePolicy"
	// DeletePolicyAdminAction - allow delete policy permission
	DeletePolicyAdminAction AdminAction = "admin:DeletePolicy"
	// GetPolicyAdminAction - allow get policy permission
	GetPolicyAdminAction AdminAction = "admin:GetPolicy"
	// AttachPolicyAdminAction - allows attaching a policy to a user/group
	AttachPolicyAdminAction AdminAction = "admin:AttachUserOrGroupPolicy"
	// UpdatePolicyAssociationAction - allows to add/remove policy association
	// on a user or group.
	UpdatePolicyAssociationAction AdminAction = "admin:UpdatePolicyAssociation"
	// ListUserPoliciesAdminAction - allows listing user policies
	ListUserPoliciesAdminAction AdminAction = "admin:ListUserPolicies"

	// SetBucketQuotaAdminAction - allow setting bucket quota
	SetBucketQuotaAdminAction AdminAction = "admin:SetBucketQuota"
	// GetBucketQuotaAdminAction - allow getting bucket quota
	GetBucketQuotaAdminAction AdminAction = "admin:GetBucketQuota"

	// SetBucketCompressionAdminAction - allow setting per-bucket compression config
	SetBucketCompressionAdminAction AdminAction = "admin:SetBucketCompression"
	// GetBucketCompressionAdminAction - allow getting per-bucket compression config
	GetBucketCompressionAdminAction AdminAction = "admin:GetBucketCompression"

	// SetBucketTargetAction - allow setting bucket target
	SetBucketTargetAction AdminAction = "admin:SetBucketTarget"
	// GetBucketTargetAction - allow getting bucket targets
	GetBucketTargetAction AdminAction = "admin:GetBucketTarget"

	// ReplicationDiff - allow computing the unreplicated objects in a bucket
	ReplicationDiff AdminAction = "admin:ReplicationDiff"

	// ImportBucketMetadataAction - allow importing bucket metadata
	ImportBucketMetadataAction AdminAction = "admin:ImportBucketMetadata"
	// ExportBucketMetadataAction - allow exporting bucket metadata
	ExportBucketMetadataAction AdminAction = "admin:ExportBucketMetadata"

	// SetTierAction - allow adding/editing a remote tier
	SetTierAction AdminAction = "admin:SetTier"
	// ListTierAction - allow listing remote tiers
	ListTierAction AdminAction = "admin:ListTier"

	// ExportIAMAction - allow exporting of all IAM info
	ExportIAMAction AdminAction = "admin:ExportIAM"
	// ImportIAMAction - allow importing IAM info to MinIO
	ImportIAMAction AdminAction = "admin:ImportIAM"

	// ListBatchJobsAction allow listing current active jobs
	ListBatchJobsAction AdminAction = "admin:ListBatchJobs"

	// DescribeBatchJobAction allow getting batch job YAML
	DescribeBatchJobAction AdminAction = "admin:DescribeBatchJob"

	// StartBatchJobAction allow submitting a batch job
	StartBatchJobAction AdminAction = "admin:StartBatchJob"

	// CancelBatchJobAction allow canceling a batch job
	CancelBatchJobAction AdminAction = "admin:CancelBatchJob"

	// GenerateBatchJobAction allow requesting batch job templates
	GenerateBatchJobAction AdminAction = "admin:GenerateBatchJob"

	// DistJobStatusAction allow viewing status of distributed jobs
	// (decommission and any future job type built on the same framework),
	// regardless of which job type is being queried.
	DistJobStatusAction AdminAction = "admin:DistJobStatus"

	// InventoryControlAction - allows control of inventory jobs
	InventoryControlAction AdminAction = "admin:InventoryControl"

	// ClusterInfoAction - allow cluster summary
	ClusterInfoAction AdminAction = "admin:ClusterInfo"

	// PoolListAction - allow list how many pools and summary per pool
	PoolListAction AdminAction = "admin:PoolList"

	// PoolInfoAction - allow pool specific summary and detail information
	PoolInfoAction AdminAction = "admin:PoolInfo"

	// NodeListAction - allow listing of nodes
	NodeListAction AdminAction = "admin:NodeList"

	// NodeInfoAction - allow node specific summary and detailed information
	NodeInfoAction AdminAction = "admin:NodeInfo"

	// SetInfoAction - allow set specific summary and detail
	SetInfoAction AdminAction = "admin:SetInfo"

	// DriveListAction - allow listing of drives
	DriveListAction AdminAction = "admin:DriveList"

	// DriveInfoAction - allow drive specific summary and detail
	DriveInfoAction AdminAction = "admin:DriveInfo"

	// DeltaSharingAdminAction - allow managing Delta Sharing shares and tokens
	DeltaSharingAdminAction AdminAction = "admin:DeltaSharing"
	// DeltaSharingCreateShareAction - allow creating Delta Sharing shares
	DeltaSharingCreateShareAction AdminAction = "admin:DeltaSharingCreateShare"
	// DeltaSharingDeleteShareAction - allow deleting Delta Sharing shares
	DeltaSharingDeleteShareAction AdminAction = "admin:DeltaSharingDeleteShare"
	// DeltaSharingListSharesAction - allow listing Delta Sharing shares
	DeltaSharingListSharesAction AdminAction = "admin:DeltaSharingListShares"
	// DeltaSharingGetShareAction - allow getting Delta Sharing share details
	DeltaSharingGetShareAction AdminAction = "admin:DeltaSharingGetShare"
	// DeltaSharingUpdateShareAction - allow updating Delta Sharing shares
	DeltaSharingUpdateShareAction AdminAction = "admin:DeltaSharingUpdateShare"
	// DeltaSharingCreateTokenAction - allow creating Delta Sharing tokens
	DeltaSharingCreateTokenAction AdminAction = "admin:DeltaSharingCreateToken"
	// DeltaSharingDeleteTokenAction - allow deleting Delta Sharing tokens
	DeltaSharingDeleteTokenAction AdminAction = "admin:DeltaSharingDeleteToken"
	// DeltaSharingListTokensAction - allow listing Delta Sharing tokens
	DeltaSharingListTokensAction AdminAction = "admin:DeltaSharingListTokens"
	// ReadAlertsAction - allow reading stored alerts
	ReadAlertsAction AdminAction = "admin:ReadAlerts"

	// ReadAPILogsAction - allow reading stored API logs
	ReadAPILogsAction AdminAction = "admin:ReadAPILogs"
	// ReadErrorLogsAction - allow reading stored error logs
	ReadErrorLogsAction AdminAction = "admin:ReadErrorLogs"
	// ReadAuditLogsAction - allow reading stored audit logs
	ReadAuditLogsAction AdminAction = "admin:ReadAuditLogs"

	// AllAdminActions - provides all admin permissions
	AllAdminActions AdminAction = "admin:*"
)

const (
	NoDecision Decision = iota
	AllowDecision
	DenyDecision
)

const (
	// Allow - allow effect.
	Allow Effect = "Allow"

	// Deny - deny effect.
	Deny = "Deny"
)

const (
	// KMSCreateKeyAction - allow creating a new KMS master key
	KMSCreateKeyAction KMSAction = "kms:CreateKey"
	// KMSDeleteKeyAction - allow deleting a KMS master key
	KMSDeleteKeyAction KMSAction = "kms:DeleteKey"
	// KMSListKeysAction - allow getting list of KMS keys
	KMSListKeysAction KMSAction = "kms:ListKeys"
	// KMSImportKeyAction - allow importing KMS key
	KMSImportKeyAction KMSAction = "kms:ImportKey"
	// KMSDescribePolicyAction - allow getting KMS policy
	KMSDescribePolicyAction KMSAction = "kms:DescribePolicy"
	// KMSAssignPolicyAction - allow assigning an identity to a KMS policy
	KMSAssignPolicyAction KMSAction = "kms:AssignPolicy"
	// KMSDeletePolicyAction - allow deleting a policy
	KMSDeletePolicyAction KMSAction = "kms:DeletePolicy"
	// KMSSetPolicyAction - allow creating or updating a policy
	KMSSetPolicyAction KMSAction = "kms:SetPolicy"
	// KMSGetPolicyAction - allow getting a policy
	KMSGetPolicyAction KMSAction = "kms:GetPolicy"
	// KMSListPoliciesAction - allow getting list of KMS policies
	KMSListPoliciesAction KMSAction = "kms:ListPolicies"
	// KMSDescribeIdentityAction - allow getting KMS identity
	KMSDescribeIdentityAction KMSAction = "kms:DescribeIdentity"
	// KMSDescribeSelfIdentityAction - allow getting self KMS identity
	KMSDescribeSelfIdentityAction KMSAction = "kms:DescribeSelfIdentity"
	// KMSDeleteIdentityAction - allow deleting a policy
	KMSDeleteIdentityAction KMSAction = "kms:DeleteIdentity"
	// KMSListIdentitiesAction - allow getting list of KMS identities
	KMSListIdentitiesAction KMSAction = "kms:ListIdentities"
	// KMSKeyStatusAction - allow getting KMS key status
	KMSKeyStatusAction KMSAction = "kms:KeyStatus"
	// KMSStatusAction - allow getting KMS status
	KMSStatusAction KMSAction = "kms:Status"
	// KMSAPIAction - allow getting a list of supported API endpoints
	KMSAPIAction KMSAction = "kms:API"
	// KMSMetricsAction - allow getting server metrics in the Prometheus exposition format
	KMSMetricsAction KMSAction = "kms:Metrics"
	// KMSVersionAction - allow getting version information
	KMSVersionAction KMSAction = "kms:Version"
	// KMSAuditLogAction - subscribes to the audit log
	KMSAuditLogAction KMSAction = "kms:AuditLog"
	// KMSErrorLogAction - subscribes to the error log
	KMSErrorLogAction KMSAction = "kms:ErrorLog"
	// AllKMSActions - provides all admin permissions
	AllKMSActions KMSAction = "kms:*"
)

const (
	// MemoryCreateCortexAction - create a Memory cortex (Memory Bucket).
	MemoryCreateCortexAction MemoryAction = "memory:CreateCortex"

	// MemoryDeleteCortexAction - delete a Memory cortex.
	MemoryDeleteCortexAction MemoryAction = "memory:DeleteCortex"

	// MemoryGetCortexAction - read a Memory cortex's metadata.
	MemoryGetCortexAction MemoryAction = "memory:GetCortex"

	// MemoryListCortexesAction - list Memory cortexes.
	MemoryListCortexesAction MemoryAction = "memory:ListCortexes"

	// MemoryPutSecretAction - write a secret in a cortex.
	MemoryPutSecretAction MemoryAction = "memory:PutSecret"

	// MemoryGetSecretAction - read a secret's decrypted value from a cortex.
	MemoryGetSecretAction MemoryAction = "memory:GetSecret"

	// MemoryDeleteSecretAction - delete a secret from a cortex.
	MemoryDeleteSecretAction MemoryAction = "memory:DeleteSecret"

	// MemoryListSecretsAction - list the secrets in a cortex.
	MemoryListSecretsAction MemoryAction = "memory:ListSecrets"

	// MemorySearchAction - search (corpus-grep) the objects in a cortex.
	MemorySearchAction MemoryAction = "memory:Search"

	// AllMemoryActions - all AIStor Memory API actions.
	AllMemoryActions MemoryAction = "memory:*"
)

const (

	// ResourceARNS3 is the ARN prefix type for S3 resources.
	ResourceARNS3 ResourceARNType

	// ResourceARNS3Tables is the ARN prefix type for Amazon S3 Tables resources.
	ResourceARNS3Tables

	// ResourceARNKMS is the ARN prefix type for MinIO KMS resources.
	ResourceARNKMS

	// ResourceARNAll is the ARN '*'
	ResourceARNAll
)

const (
	// AssumeRoleAction - use to deny or allow sts:AssumeRole action under specific conditions.
	AssumeRoleAction STSAction = "sts:AssumeRole"

	// AssumeRoleLDAPIdentityAction - use to deny or allow sts:AssumeRoleLDAPIdentity action under specific conditions.
	AssumeRoleLDAPIdentityAction STSAction = "sts:AssumeRoleLDAPIdentity"

	// AssumeRoleWithCustomTokenAction - use to deny or allow sts:AssumeRoleWithCustomToken action under specific conditions.
	AssumeRoleWithCustomTokenAction STSAction = "sts:AssumeRoleWithCustomToken"

	// AssumeRoleWithWebIdentityAction - use to deny or allow sts:AssumeRoleWithWebIdentity action under specific conditions.
	AssumeRoleWithWebIdentityAction STSAction = "sts:AssumeRoleWithWebIdentity"

	// AssumeRoleWithClientGrantsAction - use to deny or allow sts:AssumeRoleWithClientGrants action under specific conditions.
	AssumeRoleWithClientGrantsAction STSAction = "sts:AssumeRoleWithClientGrants"

	// AssumeRoleWithClientCertificateAction - use to deny or allow sts:AssumeRoleWithClientCertificate action under specific conditions.
	AssumeRoleWithClientCertificateAction STSAction = "sts:AssumeRoleWithClientCertificate"

	// AllSTSActions - select all STS actions
	AllSTSActions STSAction = "sts:*"
)

const (
	// S3TablesCreateNamespaceAction maps to the AWS `CreateNamespace` S3 Tables action.
	S3TablesCreateNamespaceAction TableAction = "s3tables:CreateNamespace"

	// S3TablesCreateTableAction maps to the AWS `CreateTable` S3 Tables action.
	S3TablesCreateTableAction TableAction = "s3tables:CreateTable"

	// S3TablesDeleteNamespaceAction maps to the AWS `DeleteNamespace` S3 Tables action.
	S3TablesDeleteNamespaceAction TableAction = "s3tables:DeleteNamespace"

	// S3TablesDeleteTableAction maps to the AWS `DeleteTable` S3 Tables action.
	S3TablesDeleteTableAction TableAction = "s3tables:DeleteTable"

	// S3TablesDeleteTablePolicyAction maps to the AWS `DeleteTablePolicy` S3 Tables action.
	S3TablesDeleteTablePolicyAction TableAction = "s3tables:DeleteTablePolicy"

	// S3TablesGetNamespaceAction maps to the AWS `GetNamespace` S3 Tables action.
	S3TablesGetNamespaceAction TableAction = "s3tables:GetNamespace"

	// S3TablesGetTableAction maps to the AWS `GetTable` S3 Tables action.
	S3TablesGetTableAction TableAction = "s3tables:GetTable"

	// S3TablesGetTableDataAction maps to the AWS `GetTableData` S3 Tables action.
	S3TablesGetTableDataAction TableAction = "s3tables:GetTableData"

	// S3TablesGetTableEncryptionAction maps to the AWS `GetTableEncryption` S3 Tables action.
	S3TablesGetTableEncryptionAction TableAction = "s3tables:GetTableEncryption"

	// S3TablesGetTableMaintenanceConfigurationAction maps to the AWS `GetTableMaintenanceConfiguration` S3 Tables action.
	S3TablesGetTableMaintenanceConfigurationAction TableAction = "s3tables:GetTableMaintenanceConfiguration"

	// S3TablesGetTableMaintenanceJobStatusAction maps to the AWS `GetTableMaintenanceJobStatus` S3 Tables action.
	S3TablesGetTableMaintenanceJobStatusAction TableAction = "s3tables:GetTableMaintenanceJobStatus"

	// S3TablesGetTableMetadataLocationAction maps to the AWS `GetTableMetadataLocation` S3 Tables action.
	S3TablesGetTableMetadataLocationAction TableAction = "s3tables:GetTableMetadataLocation"

	// S3TablesGetTablePolicyAction maps to the AWS `GetTablePolicy` S3 Tables action.
	S3TablesGetTablePolicyAction TableAction = "s3tables:GetTablePolicy"

	// S3TablesListNamespacesAction maps to the AWS `ListNamespaces` S3 Tables action.
	S3TablesListNamespacesAction TableAction = "s3tables:ListNamespaces"

	// S3TablesListTablesAction maps to the AWS `ListTables` S3 Tables action.
	S3TablesListTablesAction TableAction = "s3tables:ListTables"

	// S3TablesPutTableDataAction maps to the AWS `PutTableData` S3 Tables action.
	S3TablesPutTableDataAction TableAction = "s3tables:PutTableData"

	// S3TablesPutTableEncryptionAction maps to the AWS `PutTableEncryption` S3 Tables action.
	S3TablesPutTableEncryptionAction TableAction = "s3tables:PutTableEncryption"

	// S3TablesPutTableMaintenanceConfigurationAction maps to the AWS `PutTableMaintenanceConfiguration` S3 Tables action.
	S3TablesPutTableMaintenanceConfigurationAction TableAction = "s3tables:PutTableMaintenanceConfiguration"

	// S3TablesPutTablePolicyAction maps to the AWS `PutTablePolicy` S3 Tables action.
	S3TablesPutTablePolicyAction TableAction = "s3tables:PutTablePolicy"

	// S3TablesRegisterTableAction maps to the AWS `RegisterTable` S3 Tables action.
	S3TablesRegisterTableAction TableAction = "s3tables:RegisterTable"

	// S3TablesRenameTableAction maps to the AWS `RenameTable` S3 Tables action.
	S3TablesRenameTableAction TableAction = "s3tables:RenameTable"

	// S3TablesUpdateTableMetadataLocationAction maps to the AWS `UpdateTableMetadataLocation` S3 Tables action.
	S3TablesUpdateTableMetadataLocationAction TableAction = "s3tables:UpdateTableMetadataLocation"

	// S3TablesCreateWarehouseAction is a MinIO extension for Iceberg warehouse provisioning.
	S3TablesCreateWarehouseAction TableAction = "s3tables:CreateWarehouse"

	// S3TablesCreateTableBucketAction maps to the AWS `CreateTableBucket` S3 Tables action.
	// Prefer using S3TablesCreateWarehouseAction instead.
	S3TablesCreateTableBucketAction TableAction = "s3tables:CreateTableBucket"

	// S3TablesDeleteWarehouseAction is a MinIO extension for deleting Iceberg warehouses.
	S3TablesDeleteWarehouseAction TableAction = "s3tables:DeleteWarehouse"

	// S3TablesDeleteTableBucketAction maps to the AWS `DeleteTableBucket` S3 Tables action.
	// Prefer using S3TablesDeleteWarehouseAction instead.
	S3TablesDeleteTableBucketAction TableAction = "s3tables:DeleteTableBucket"

	// S3TablesDeleteWarehouseEncryptionAction is a MinIO extension for deleting warehouse encryption configuration.
	S3TablesDeleteWarehouseEncryptionAction TableAction = "s3tables:DeleteWarehouseEncryption"

	// S3TablesDeleteTableBucketEncryptionAction maps to the AWS `DeleteTableBucketEncryption` S3 Tables action.
	// Prefer using S3TablesDeleteWarehouseEncryptionAction instead.
	S3TablesDeleteTableBucketEncryptionAction TableAction = "s3tables:DeleteTableBucketEncryption"

	// S3TablesDeleteWarehousePolicyAction is a MinIO extension for deleting warehouse policies.
	S3TablesDeleteWarehousePolicyAction TableAction = "s3tables:DeleteWarehousePolicy"

	// S3TablesDeleteTableBucketPolicyAction maps to the AWS `DeleteTableBucketPolicy` S3 Tables action.
	// Prefer using S3TablesDeleteWarehousePolicyAction instead.
	S3TablesDeleteTableBucketPolicyAction TableAction = "s3tables:DeleteTableBucketPolicy"

	// S3TablesGetWarehouseAction is a MinIO extension for retrieving warehouse details.
	S3TablesGetWarehouseAction TableAction = "s3tables:GetWarehouse"

	// S3TablesGetTableBucketAction maps to the AWS `GetTableBucket` S3 Tables action.
	// Prefer using S3TablesGetWarehouseAction instead.
	S3TablesGetTableBucketAction TableAction = "s3tables:GetTableBucket"

	// S3TablesGetWarehouseEncryptionAction is a MinIO extension for retrieving warehouse encryption configuration.
	S3TablesGetWarehouseEncryptionAction TableAction = "s3tables:GetWarehouseEncryption"

	// S3TablesGetTableBucketEncryptionAction maps to the AWS `GetTableBucketEncryption` S3 Tables action.
	// Prefer using S3TablesGetWarehouseEncryptionAction instead.
	S3TablesGetTableBucketEncryptionAction TableAction = "s3tables:GetTableBucketEncryption"

	// S3TablesGetWarehouseMaintenanceConfigurationAction is a MinIO extension for retrieving warehouse maintenance configuration.
	S3TablesGetWarehouseMaintenanceConfigurationAction TableAction = "s3tables:GetWarehouseMaintenanceConfiguration"

	// S3TablesGetTableBucketMaintenanceConfigurationAction maps to the AWS `GetTableBucketMaintenanceConfiguration` S3 Tables action.
	// Prefer using S3TablesGetWarehouseMaintenanceConfigurationAction instead.
	S3TablesGetTableBucketMaintenanceConfigurationAction TableAction = "s3tables:GetTableBucketMaintenanceConfiguration"

	// S3TablesGetWarehousePolicyAction is a MinIO extension for retrieving warehouse policies.
	S3TablesGetWarehousePolicyAction TableAction = "s3tables:GetWarehousePolicy"

	// S3TablesGetTableBucketPolicyAction maps to the AWS `GetTableBucketPolicy` S3 Tables action.
	// Prefer using S3TablesGetWarehousePolicyAction instead.
	S3TablesGetTableBucketPolicyAction TableAction = "s3tables:GetTableBucketPolicy"

	// S3TablesListWarehousesAction is a MinIO extension for listing Iceberg warehouses.
	S3TablesListWarehousesAction TableAction = "s3tables:ListWarehouses"

	// S3TablesListTableBucketsAction maps to the AWS `ListTableBuckets` S3 Tables action.
	// Prefer using S3TablesListWarehousesAction instead.
	S3TablesListTableBucketsAction TableAction = "s3tables:ListTableBuckets"

	// S3TablesPutWarehouseEncryptionAction is a MinIO extension for setting warehouse encryption configuration.
	S3TablesPutWarehouseEncryptionAction TableAction = "s3tables:PutWarehouseEncryption"

	// S3TablesPutTableBucketEncryptionAction maps to the AWS `PutTableBucketEncryption` S3 Tables action.
	// Prefer using S3TablesPutWarehouseEncryptionAction instead.
	S3TablesPutTableBucketEncryptionAction TableAction = "s3tables:PutTableBucketEncryption"

	// S3TablesPutWarehouseMaintenanceConfigurationAction is a MinIO extension for setting warehouse maintenance configuration.
	S3TablesPutWarehouseMaintenanceConfigurationAction TableAction = "s3tables:PutWarehouseMaintenanceConfiguration"

	// S3TablesPutTableBucketMaintenanceConfigurationAction maps to the AWS `PutTableBucketMaintenanceConfiguration` S3 Tables action.
	// Prefer using S3TablesPutWarehouseMaintenanceConfigurationAction instead.
	S3TablesPutTableBucketMaintenanceConfigurationAction TableAction = "s3tables:PutTableBucketMaintenanceConfiguration"

	// S3TablesPutWarehousePolicyAction is a MinIO extension for setting warehouse policies.
	S3TablesPutWarehousePolicyAction TableAction = "s3tables:PutWarehousePolicy"

	// S3TablesPutTableBucketPolicyAction maps to the AWS `PutTableBucketPolicy` S3 Tables action.
	// Prefer using S3TablesPutWarehousePolicyAction instead.
	S3TablesPutTableBucketPolicyAction TableAction = "s3tables:PutTableBucketPolicy"

	// S3TablesGetConfigAction is a MinIO extension for retrieving catalog configuration.
	S3TablesGetConfigAction TableAction = "s3tables:GetConfig"

	// S3TablesTableMetricsAction is a MinIO extension exposing table metrics.
	S3TablesTableMetricsAction TableAction = "s3tables:TableMetrics"

	// S3TablesUpdateTableAction is a MinIO extension for Iceberg-compatible table updates.
	S3TablesUpdateTableAction TableAction = "s3tables:UpdateTable"

	// S3TablesCreateViewAction is a MinIO extension for creating Iceberg views.
	S3TablesCreateViewAction TableAction = "s3tables:CreateView"

	// S3TablesDeleteViewAction is a MinIO extension for deleting Iceberg views.
	S3TablesDeleteViewAction TableAction = "s3tables:DeleteView"

	// S3TablesGetViewAction is a MinIO extension for retrieving Iceberg views.
	S3TablesGetViewAction TableAction = "s3tables:GetView"

	// S3TablesRenameViewAction is a MinIO extension for renaming Iceberg views.
	S3TablesRenameViewAction TableAction = "s3tables:RenameView"

	// S3TablesUpdateViewAction is a MinIO extension for updating Iceberg views.
	S3TablesUpdateViewAction TableAction = "s3tables:UpdateView"

	// S3TablesListViewsAction is a MinIO extension for listing Iceberg views.
	S3TablesListViewsAction TableAction = "s3tables:ListViews"

	// S3TablesRegisterViewAction is a MinIO extension for registering Iceberg views.
	S3TablesRegisterViewAction TableAction = "s3tables:RegisterView"

	// S3TablesCreateFunctionAction is a MinIO extension for creating Iceberg functions (SQL UDFs).
	S3TablesCreateFunctionAction TableAction = "s3tables:CreateFunction"

	// S3TablesDeleteFunctionAction is a MinIO extension for deleting Iceberg functions (SQL UDFs).
	S3TablesDeleteFunctionAction TableAction = "s3tables:DeleteFunction"

	// S3TablesGetFunctionAction is a MinIO extension for retrieving Iceberg functions (SQL UDFs).
	S3TablesGetFunctionAction TableAction = "s3tables:GetFunction"

	// S3TablesRenameFunctionAction is a MinIO extension for renaming Iceberg functions (SQL UDFs).
	S3TablesRenameFunctionAction TableAction = "s3tables:RenameFunction"

	// S3TablesUpdateFunctionAction is a MinIO extension for updating Iceberg functions (SQL UDFs).
	S3TablesUpdateFunctionAction TableAction = "s3tables:UpdateFunction"

	// S3TablesListFunctionsAction is a MinIO extension for listing Iceberg functions (SQL UDFs).
	S3TablesListFunctionsAction TableAction = "s3tables:ListFunctions"

	// S3TablesRegisterFunctionAction is a MinIO extension for registering Iceberg functions (SQL UDFs).
	S3TablesRegisterFunctionAction TableAction = "s3tables:RegisterFunction"

	// S3TablesUpdateNamespacePropertiesAction is a MinIO extension for updating namespace properties.
	S3TablesUpdateNamespacePropertiesAction TableAction = "s3tables:UpdateNamespaceProperties"

	// S3TablesTagWarehouseAction is a MinIO extension for tagging Iceberg warehouses.
	S3TablesTagWarehouseAction TableAction = "s3tables:TagWarehouse"
	// S3TablesUntagWarehouseAction is a MinIO extension for removing tags from Iceberg warehouses.
	S3TablesUntagWarehouseAction TableAction = "s3tables:UntagWarehouse"
	// S3TablesListTagsForWarehouseAction is a MinIO extension for listing tags on Iceberg warehouses.
	S3TablesListTagsForWarehouseAction TableAction = "s3tables:ListTagsForWarehouse"

	// S3TablesTagTableAction is a MinIO extension for tagging tables.
	S3TablesTagTableAction TableAction = "s3tables:TagTable"
	// S3TablesUntagTableAction is a MinIO extension for removing tags from tables.
	S3TablesUntagTableAction TableAction = "s3tables:UntagTable"
	// S3TablesListTagsForTableAction is a MinIO extension for listing tags on tables.
	S3TablesListTagsForTableAction TableAction = "s3tables:ListTagsForTable"

	// AllS3TablesActions - all Amazon S3 Tables actions
	AllS3TablesActions TableAction = "s3tables:*"
)

const (
	// S3VectorsCreateVectorBucketAction maps to the AWS `CreateVectorBucket` S3 Vectors action.
	S3VectorsCreateVectorBucketAction VectorsAction = "s3vectors:CreateVectorBucket"

	// S3VectorsDeleteVectorBucketAction maps to the AWS `DeleteVectorBucket` S3 Vectors action.
	S3VectorsDeleteVectorBucketAction VectorsAction = "s3vectors:DeleteVectorBucket"

	// S3VectorsGetVectorBucketAction maps to the AWS `GetVectorBucket` S3 Vectors action.
	S3VectorsGetVectorBucketAction VectorsAction = "s3vectors:GetVectorBucket"

	// S3VectorsListVectorBucketsAction maps to the AWS `ListVectorBuckets` S3 Vectors action.
	S3VectorsListVectorBucketsAction VectorsAction = "s3vectors:ListVectorBuckets"

	// S3VectorsCreateIndexAction maps to the AWS `CreateIndex` S3 Vectors action.
	S3VectorsCreateIndexAction VectorsAction = "s3vectors:CreateIndex"

	// S3VectorsDeleteIndexAction maps to the AWS `DeleteIndex` S3 Vectors action.
	S3VectorsDeleteIndexAction VectorsAction = "s3vectors:DeleteIndex"

	// S3VectorsGetIndexAction maps to the AWS `GetIndex` S3 Vectors action.
	S3VectorsGetIndexAction VectorsAction = "s3vectors:GetIndex"

	// S3VectorsListIndexesAction maps to the AWS `ListIndexes` S3 Vectors action.
	S3VectorsListIndexesAction VectorsAction = "s3vectors:ListIndexes"

	// S3VectorsPutVectorsAction maps to the AWS `PutVectors` S3 Vectors action.
	S3VectorsPutVectorsAction VectorsAction = "s3vectors:PutVectors"

	// S3VectorsGetVectorsAction maps to the AWS `GetVectors` S3 Vectors action.
	S3VectorsGetVectorsAction VectorsAction = "s3vectors:GetVectors"

	// S3VectorsDeleteVectorsAction maps to the AWS `DeleteVectors` S3 Vectors action.
	S3VectorsDeleteVectorsAction VectorsAction = "s3vectors:DeleteVectors"

	// S3VectorsListVectorsAction maps to the AWS `ListVectors` S3 Vectors action.
	S3VectorsListVectorsAction VectorsAction = "s3vectors:ListVectors"

	// S3VectorsQueryVectorsAction maps to the AWS `QueryVectors` S3 Vectors action.
	S3VectorsQueryVectorsAction VectorsAction = "s3vectors:QueryVectors"

	// AllS3VectorsActions - all Amazon S3 Vectors actions
	AllS3VectorsActions VectorsAction = "s3vectors:*"
)