snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/iamapi/iamapi_authz_test.go

@@ -0,0 +1,143 @@
+package iamapi
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A data-plane identity holding nothing but the equivalent of AmazonS3FullAccess,
+// and an admin, so the same request can be run from both sides. The admin key is
+// obviously fake to keep secret scanners quiet.
+const authzConfigJSON = `{
+  "identities": [
+    {
+      "name": "power_user",
+      "credentials": [{"accessKey": "AKIAIOSFODNN7EXAMPLE", "secretKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"}],
+      "policyNames": ["PowerUserPolicy"]
+    },
+    {
+      "name": "iam_admin",
+      "credentials": [{"accessKey": "AKIATESTFAKEADMIN0001", "secretKey": "testAdminSecretFake0000000000000000000000"}],
+      "actions": ["Admin"]
+    }
+  ],
+  "policies": [
+    {
+      "name": "PowerUserPolicy",
+      "content": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"*\"}]}"
+    }
+  ]
+}`
+
+func newAuthzTestServer(t *testing.T) *httptest.Server {
+	t.Helper()
+
+	config := &iam_pb.S3ApiConfiguration{}
+	require.NoError(t, filer.ParseS3ConfigurationFromBytes([]byte(authzConfigJSON), config))
+
+	store := &memory.MemoryStore{}
+	require.NoError(t, store.Initialize(nil, ""))
+	cm := &credential.CredentialManager{Store: store}
+	require.NoError(t, cm.SaveConfiguration(context.Background(), config))
+
+	iam := &s3api.IdentityAccessManagement{}
+	iam.SetCredentialManagerForTest(cm)
+	require.NoError(t, iam.LoadS3ApiConfigurationFromBytes([]byte(authzConfigJSON)))
+
+	iama := &IamApiServer{
+		iam:         iam,
+		s3ApiConfig: &countingConfigSaver{cm: cm},
+	}
+	router := mux.NewRouter().SkipClean(true)
+	iama.registerRouter(router)
+
+	server := httptest.NewServer(router)
+	t.Cleanup(server.Close)
+	return server
+}
+
+func postSignedIamAction(t *testing.T, serverURL, accessKey, secretKey, rawQuery, body string) *http.Response {
+	t.Helper()
+
+	url := serverURL + "/"
+	if rawQuery != "" {
+		url += "?" + rawQuery
+	}
+	req, err := http.NewRequest(http.MethodPost, url, strings.NewReader(body))
+	require.NoError(t, err)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	payloadHash := fmt.Sprintf("%x", sha256.Sum256([]byte(body)))
+	require.NoError(t, v4.NewSigner().SignHTTP(context.Background(),
+		aws.Credentials{AccessKeyID: accessKey, SecretAccessKey: secretKey},
+		req, payloadHash, "iam", "us-east-1", time.Now()))
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	t.Cleanup(func() { resp.Body.Close() })
+	return resp
+}
+
+// An S3 data-plane policy grants no IAM management, however broad it is: the
+// standalone server used to check these actions as a coarse S3 action, which
+// such a policy matches.
+func TestIamManagementDeniedForDataPlanePolicy(t *testing.T) {
+	server := newAuthzTestServer(t)
+
+	for _, action := range []string{"CreateUser", "CreateAccessKey", "PutUserPolicy", "AttachUserPolicy"} {
+		t.Run(action, func(t *testing.T) {
+			resp := postSignedIamAction(t, server.URL, "AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+				"", "Action="+action+"&UserName=victim&Version=2010-05-08")
+			assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+		})
+	}
+}
+
+// Same expectation when the request carries an S3 query parameter, which the
+// action resolver used to read even for an IAM action.
+func TestIamManagementDeniedWithS3QueryParameter(t *testing.T) {
+	server := newAuthzTestServer(t)
+
+	for _, rawQuery := range []string{"delete", "acl", "tagging", "policy"} {
+		t.Run(rawQuery, func(t *testing.T) {
+			resp := postSignedIamAction(t, server.URL, "AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+				rawQuery, "Action=CreateUser&UserName=victim&Version=2010-05-08")
+			assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+		})
+	}
+}
+
+// Self-service still works without an IAM grant, matching AWS and the embedded
+// IAM surface: a user may rotate its own access keys.
+func TestIamSelfServiceAllowedForDataPlanePolicy(t *testing.T) {
+	server := newAuthzTestServer(t)
+
+	resp := postSignedIamAction(t, server.URL, "AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+		"", "Action=ListAccessKeys&Version=2010-05-08")
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+}
+
+func TestIamManagementAllowedForAdmin(t *testing.T) {
+	server := newAuthzTestServer(t)
+
+	resp := postSignedIamAction(t, server.URL, "AKIATESTFAKEADMIN0001", "testAdminSecretFake0000000000000000000000",
+		"", "Action=CreateUser&UserName=new-user&Version=2010-05-08")
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+}

weed/iamapi/iamapi_group_handlers.go

@@ -0,0 +1,571 @@
+package iamapi
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/url"
+	"sort"
+
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	iamlib "github.com/seaweedfs/seaweedfs/weed/iam"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+func (iama *IamApiServer) CreateGroup(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*CreateGroupResponse, *IamError) {
+	resp := &CreateGroupResponse{}
+	groupName := values.Get("GroupName")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			return resp, &IamError{Code: iam.ErrCodeEntityAlreadyExistsException, Error: fmt.Errorf("group %s already exists", groupName)}
+		}
+	}
+	s3cfg.Groups = append(s3cfg.Groups, &iam_pb.Group{Name: groupName})
+	resp.CreateGroupResult.Group.GroupName = &groupName
+	return resp, nil
+}
+
+func (iama *IamApiServer) DeleteGroup(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*DeleteGroupResponse, *IamError) {
+	resp := &DeleteGroupResponse{}
+	groupName := values.Get("GroupName")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	for i, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			if len(g.Members) > 0 {
+				return resp, &IamError{Code: iam.ErrCodeDeleteConflictException, Error: fmt.Errorf("cannot delete group %s: group has %d member(s)", groupName, len(g.Members))}
+			}
+			if len(g.PolicyNames) > 0 {
+				return resp, &IamError{Code: iam.ErrCodeDeleteConflictException, Error: fmt.Errorf("cannot delete group %s: group has %d attached policy(ies)", groupName, len(g.PolicyNames))}
+			}
+			// Check for inline policies
+			policies := Policies{}
+			if pErr := iama.s3ApiConfig.GetPolicies(&policies); pErr != nil && !errors.Is(pErr, filer_pb.ErrNotFound) {
+				return resp, &IamError{Code: iam.ErrCodeServiceFailureException, Error: pErr}
+			}
+			if gp := policies.GroupInlinePolicies[groupName]; len(gp) > 0 {
+				return resp, &IamError{Code: iam.ErrCodeDeleteConflictException, Error: fmt.Errorf("cannot delete group %s: group has %d inline policy(ies)", groupName, len(gp))}
+			}
+			s3cfg.Groups = append(s3cfg.Groups[:i], s3cfg.Groups[i+1:]...)
+			// Clean up any empty inline policy entries, reuse already-fetched policies
+			if err := cleanupGroupInlinePolicies(iama, groupName, &policies); err != nil {
+				glog.Warningf("Failed to cleanup inline policies for group %s: %v", groupName, err)
+			}
+			return resp, nil
+		}
+	}
+	return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+}
+
+func (iama *IamApiServer) UpdateGroup(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*UpdateGroupResponse, *IamError) {
+	resp := &UpdateGroupResponse{}
+	groupName := values.Get("GroupName")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			if disabled := values.Get("Disabled"); disabled != "" {
+				if disabled != "true" && disabled != "false" {
+					return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("Disabled must be 'true' or 'false'")}
+				}
+				g.Disabled = disabled == "true"
+			}
+			if newName := values.Get("NewGroupName"); newName != "" && newName != g.Name {
+				for _, other := range s3cfg.Groups {
+					if other.Name == newName {
+						return resp, &IamError{Code: iam.ErrCodeEntityAlreadyExistsException, Error: fmt.Errorf("group %s already exists", newName)}
+					}
+				}
+				oldName := g.Name
+				g.Name = newName
+				if err := migrateGroupInlinePolicies(iama, oldName, newName); err != nil {
+					glog.Warningf("Failed to migrate inline policies for group rename %s -> %s: %v", oldName, newName, err)
+				}
+			}
+			return resp, nil
+		}
+	}
+	return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+}
+
+func (iama *IamApiServer) GetGroup(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*GetGroupResponse, *IamError) {
+	resp := &GetGroupResponse{}
+	groupName := values.Get("GroupName")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			resp.GetGroupResult.Group.GroupName = &g.Name
+			for _, member := range g.Members {
+				user := iamlib.NewUser(member)
+				resp.GetGroupResult.Users = append(resp.GetGroupResult.Users, &user)
+			}
+			return resp, nil
+		}
+	}
+	return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+}
+
+func (iama *IamApiServer) ListGroups(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) *ListGroupsResponse {
+	resp := &ListGroupsResponse{}
+	for _, g := range s3cfg.Groups {
+		name := g.Name
+		resp.ListGroupsResult.Groups = append(resp.ListGroupsResult.Groups, &iam.Group{GroupName: &name})
+	}
+	return resp
+}
+
+func (iama *IamApiServer) AddUserToGroup(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*AddUserToGroupResponse, *IamError) {
+	resp := &AddUserToGroupResponse{}
+	groupName := values.Get("GroupName")
+	userName := values.Get("UserName")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	if userName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("UserName is required")}
+	}
+	userFound := false
+	for _, ident := range s3cfg.Identities {
+		if ident.Name == userName {
+			userFound = true
+			break
+		}
+	}
+	if !userFound {
+		return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("user %s does not exist", userName)}
+	}
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			for _, m := range g.Members {
+				if m == userName {
+					return resp, nil
+				}
+			}
+			g.Members = append(g.Members, userName)
+			return resp, nil
+		}
+	}
+	return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+}
+
+func (iama *IamApiServer) RemoveUserFromGroup(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*RemoveUserFromGroupResponse, *IamError) {
+	resp := &RemoveUserFromGroupResponse{}
+	groupName := values.Get("GroupName")
+	userName := values.Get("UserName")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	if userName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("UserName is required")}
+	}
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			for i, m := range g.Members {
+				if m == userName {
+					g.Members = append(g.Members[:i], g.Members[i+1:]...)
+					return resp, nil
+				}
+			}
+			return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("user %s is not a member of group %s", userName, groupName)}
+		}
+	}
+	return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+}
+
+func (iama *IamApiServer) AttachGroupPolicy(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*AttachGroupPolicyResponse, *IamError) {
+	resp := &AttachGroupPolicyResponse{}
+	groupName := values.Get("GroupName")
+	policyArn := values.Get("PolicyArn")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	policyName, iamErr := parsePolicyArn(policyArn)
+	if iamErr != nil {
+		return resp, iamErr
+	}
+	// Verify policy exists in the persisted policies store
+	policies := Policies{}
+	if pErr := iama.s3ApiConfig.GetPolicies(&policies); pErr != nil && !errors.Is(pErr, filer_pb.ErrNotFound) {
+		return resp, &IamError{Code: iam.ErrCodeServiceFailureException, Error: pErr}
+	}
+	if _, exists := policies.Policies[policyName]; !exists {
+		return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("policy %s not found", policyName)}
+	}
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			for _, p := range g.PolicyNames {
+				if p == policyName {
+					return resp, nil
+				}
+			}
+			g.PolicyNames = append(g.PolicyNames, policyName)
+			return resp, nil
+		}
+	}
+	return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+}
+
+func (iama *IamApiServer) DetachGroupPolicy(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*DetachGroupPolicyResponse, *IamError) {
+	resp := &DetachGroupPolicyResponse{}
+	groupName := values.Get("GroupName")
+	policyArn := values.Get("PolicyArn")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	policyName, iamErr := parsePolicyArn(policyArn)
+	if iamErr != nil {
+		return resp, iamErr
+	}
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			for i, p := range g.PolicyNames {
+				if p == policyName {
+					g.PolicyNames = append(g.PolicyNames[:i], g.PolicyNames[i+1:]...)
+					return resp, nil
+				}
+			}
+			return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("policy %s is not attached to group %s", policyName, groupName)}
+		}
+	}
+	return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+}
+
+func (iama *IamApiServer) ListAttachedGroupPolicies(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*ListAttachedGroupPoliciesResponse, *IamError) {
+	resp := &ListAttachedGroupPoliciesResponse{}
+	groupName := values.Get("GroupName")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			for _, policyName := range g.PolicyNames {
+				pn := policyName
+				policyArn := policyArnPrefix + pn
+				resp.ListAttachedGroupPoliciesResult.AttachedPolicies = append(resp.ListAttachedGroupPoliciesResult.AttachedPolicies, &iam.AttachedPolicy{
+					PolicyName: &pn,
+					PolicyArn:  &policyArn,
+				})
+			}
+			return resp, nil
+		}
+	}
+	return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+}
+
+func (iama *IamApiServer) ListGroupsForUser(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*ListGroupsForUserResponse, *IamError) {
+	resp := &ListGroupsForUserResponse{}
+	userName := values.Get("UserName")
+	if userName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("UserName is required")}
+	}
+	userFound := false
+	for _, ident := range s3cfg.Identities {
+		if ident.Name == userName {
+			userFound = true
+			break
+		}
+	}
+	if !userFound {
+		return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("user %s does not exist", userName)}
+	}
+	// Build reverse index for efficient lookup
+	userGroupsIndex := buildUserGroupsIndex(s3cfg)
+	for _, gName := range userGroupsIndex[userName] {
+		name := gName
+		resp.ListGroupsForUserResult.Groups = append(resp.ListGroupsForUserResult.Groups, &iam.Group{GroupName: &name})
+	}
+	return resp, nil
+}
+
+// removeUserFromAllGroups removes a user from all groups they belong to.
+// Uses a reverse index for efficient lookup of which groups to modify.
+func removeUserFromAllGroups(s3cfg *iam_pb.S3ApiConfiguration, userName string) {
+	userGroupsIndex := buildUserGroupsIndex(s3cfg)
+	groupNames, found := userGroupsIndex[userName]
+	if !found {
+		return
+	}
+	// Build a set for fast group name lookup
+	targetGroups := make(map[string]bool, len(groupNames))
+	for _, gn := range groupNames {
+		targetGroups[gn] = true
+	}
+	for _, g := range s3cfg.Groups {
+		if !targetGroups[g.Name] {
+			continue
+		}
+		for i, m := range g.Members {
+			if m == userName {
+				g.Members = append(g.Members[:i], g.Members[i+1:]...)
+				break
+			}
+		}
+	}
+}
+
+// updateUserInGroups updates group membership references when a user is renamed.
+func updateUserInGroups(s3cfg *iam_pb.S3ApiConfiguration, oldUserName, newUserName string) {
+	for _, g := range s3cfg.Groups {
+		for i, m := range g.Members {
+			if m == oldUserName {
+				g.Members[i] = newUserName
+				break
+			}
+		}
+	}
+}
+
+// isPolicyAttachedToAnyGroup checks if a policy is attached to any group.
+func isPolicyAttachedToAnyGroup(s3cfg *iam_pb.S3ApiConfiguration, policyName string) (string, bool) {
+	for _, g := range s3cfg.Groups {
+		for _, p := range g.PolicyNames {
+			if p == policyName {
+				return g.Name, true
+			}
+		}
+	}
+	return "", false
+}
+
+// buildUserGroupsIndex builds a reverse index mapping usernames to group names.
+func buildUserGroupsIndex(s3cfg *iam_pb.S3ApiConfiguration) map[string][]string {
+	index := make(map[string][]string)
+	for _, g := range s3cfg.Groups {
+		for _, m := range g.Members {
+			index[m] = append(index[m], g.Name)
+		}
+	}
+	return index
+}
+
+// PutGroupPolicy attaches an inline policy to a group.
+// https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutGroupPolicy.html
+func (iama *IamApiServer) PutGroupPolicy(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*PutGroupPolicyResponse, *IamError) {
+	resp := &PutGroupPolicyResponse{}
+	groupName := values.Get("GroupName")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	policyName := values.Get("PolicyName")
+	if policyName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("PolicyName is required")}
+	}
+	policyDocumentString := values.Get("PolicyDocument")
+	if policyDocumentString == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("PolicyDocument is required")}
+	}
+	policyDocument, err := GetPolicyDocument(&policyDocumentString)
+	if err != nil {
+		return resp, &IamError{Code: iam.ErrCodeMalformedPolicyDocumentException, Error: err}
+	}
+	if _, err := GetActions(&policyDocument); err != nil {
+		return resp, &IamError{Code: iam.ErrCodeMalformedPolicyDocumentException, Error: err}
+	}
+
+	// Find group and get its members for action recomputation
+	var targetGroup *iam_pb.Group
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			targetGroup = g
+			break
+		}
+	}
+	if targetGroup == nil {
+		return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+	}
+
+	// Persist inline policy
+	policies := Policies{}
+	if pErr := iama.s3ApiConfig.GetPolicies(&policies); pErr != nil && !errors.Is(pErr, filer_pb.ErrNotFound) {
+		return resp, &IamError{Code: iam.ErrCodeServiceFailureException, Error: pErr}
+	}
+	groupPolicies := policies.getOrCreateGroupPolicies(groupName)
+	groupPolicies[policyName] = policyDocument
+	if pErr := iama.s3ApiConfig.PutPolicies(&policies); pErr != nil {
+		return resp, &IamError{Code: iam.ErrCodeServiceFailureException, Error: pErr}
+	}
+
+	// Recompute actions for all group members
+	recomputeActionsForGroupMembers(iama, s3cfg, targetGroup, &policies)
+
+	return resp, nil
+}
+
+// GetGroupPolicy gets an inline policy attached to a group.
+// https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetGroupPolicy.html
+func (iama *IamApiServer) GetGroupPolicy(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*GetGroupPolicyResponse, *IamError) {
+	resp := &GetGroupPolicyResponse{}
+	groupName := values.Get("GroupName")
+	policyName := values.Get("PolicyName")
+
+	// Verify group exists
+	found := false
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			found = true
+			break
+		}
+	}
+	if !found {
+		return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+	}
+
+	policies := Policies{}
+	if pErr := iama.s3ApiConfig.GetPolicies(&policies); pErr != nil && !errors.Is(pErr, filer_pb.ErrNotFound) {
+		return resp, &IamError{Code: iam.ErrCodeServiceFailureException, Error: pErr}
+	}
+
+	if groupPolicies := policies.GroupInlinePolicies[groupName]; groupPolicies != nil {
+		if policyDocument, exists := groupPolicies[policyName]; exists {
+			policyDocumentJSON, err := json.Marshal(policyDocument)
+			if err != nil {
+				return resp, &IamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+			}
+			resp.GetGroupPolicyResult.GroupName = groupName
+			resp.GetGroupPolicyResult.PolicyName = policyName
+			resp.GetGroupPolicyResult.PolicyDocument = string(policyDocumentJSON)
+			return resp, nil
+		}
+	}
+	return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("policy %s not found on group %s", policyName, groupName)}
+}
+
+// DeleteGroupPolicy removes an inline policy from a group.
+// https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroupPolicy.html
+func (iama *IamApiServer) DeleteGroupPolicy(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*DeleteGroupPolicyResponse, *IamError) {
+	resp := &DeleteGroupPolicyResponse{}
+	groupName := values.Get("GroupName")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+	policyName := values.Get("PolicyName")
+	if policyName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("PolicyName is required")}
+	}
+
+	// Find group for member action recomputation
+	var targetGroup *iam_pb.Group
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			targetGroup = g
+			break
+		}
+	}
+	if targetGroup == nil {
+		return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+	}
+
+	policies := Policies{}
+	if pErr := iama.s3ApiConfig.GetPolicies(&policies); pErr != nil && !errors.Is(pErr, filer_pb.ErrNotFound) {
+		return resp, &IamError{Code: iam.ErrCodeServiceFailureException, Error: pErr}
+	}
+	if groupPolicies := policies.GroupInlinePolicies[groupName]; groupPolicies != nil {
+		delete(groupPolicies, policyName)
+		if pErr := iama.s3ApiConfig.PutPolicies(&policies); pErr != nil {
+			return resp, &IamError{Code: iam.ErrCodeServiceFailureException, Error: pErr}
+		}
+	}
+
+	// Recompute actions for all group members
+	recomputeActionsForGroupMembers(iama, s3cfg, targetGroup, &policies)
+
+	return resp, nil
+}
+
+// ListGroupPolicies lists the names of inline policies attached to a group.
+// https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroupPolicies.html
+func (iama *IamApiServer) ListGroupPolicies(s3cfg *iam_pb.S3ApiConfiguration, values url.Values) (*ListGroupPoliciesResponse, *IamError) {
+	resp := &ListGroupPoliciesResponse{}
+	groupName := values.Get("GroupName")
+	if groupName == "" {
+		return resp, &IamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("GroupName is required")}
+	}
+
+	// Verify group exists
+	found := false
+	for _, g := range s3cfg.Groups {
+		if g.Name == groupName {
+			found = true
+			break
+		}
+	}
+	if !found {
+		return resp, &IamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("group %s does not exist", groupName)}
+	}
+
+	policies := Policies{}
+	if pErr := iama.s3ApiConfig.GetPolicies(&policies); pErr != nil && !errors.Is(pErr, filer_pb.ErrNotFound) {
+		return resp, &IamError{Code: iam.ErrCodeServiceFailureException, Error: pErr}
+	}
+	if groupPolicies := policies.GroupInlinePolicies[groupName]; groupPolicies != nil {
+		for policyName := range groupPolicies {
+			resp.ListGroupPoliciesResult.PolicyNames = append(resp.ListGroupPoliciesResult.PolicyNames, policyName)
+		}
+		sort.Strings(resp.ListGroupPoliciesResult.PolicyNames)
+	}
+	resp.ListGroupPoliciesResult.IsTruncated = false
+	return resp, nil
+}
+
+// cleanupGroupInlinePolicies removes all inline policies for a group from persistent storage.
+// If policies is provided, it uses that to avoid redundant I/O; otherwise fetches from storage.
+func cleanupGroupInlinePolicies(iama *IamApiServer, groupName string, policies *Policies) error {
+	if policies == nil {
+		policies = &Policies{}
+		if err := iama.s3ApiConfig.GetPolicies(policies); err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+			return err
+		}
+	}
+	if _, exists := policies.GroupInlinePolicies[groupName]; exists {
+		delete(policies.GroupInlinePolicies, groupName)
+		return iama.s3ApiConfig.PutPolicies(policies)
+	}
+	return nil
+}
+
+// migrateGroupInlinePolicies renames the inline policies key when a group is renamed.
+func migrateGroupInlinePolicies(iama *IamApiServer, oldName, newName string) error {
+	policies := Policies{}
+	if err := iama.s3ApiConfig.GetPolicies(&policies); err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		return err
+	}
+	if oldPolicies, exists := policies.GroupInlinePolicies[oldName]; exists {
+		if policies.GroupInlinePolicies == nil {
+			policies.GroupInlinePolicies = make(map[string]map[string]policy_engine.PolicyDocument)
+		}
+		policies.GroupInlinePolicies[newName] = oldPolicies
+		delete(policies.GroupInlinePolicies, oldName)
+		return iama.s3ApiConfig.PutPolicies(&policies)
+	}
+	return nil
+}
+
+// recomputeActionsForGroupMembers recomputes the aggregated actions for all members of a group.
+// Uses an identity index for O(N+M) complexity instead of O(N*M).
+func recomputeActionsForGroupMembers(iama *IamApiServer, s3cfg *iam_pb.S3ApiConfiguration, group *iam_pb.Group, policies *Policies) {
+	// Build name -> identity index for O(1) lookup
+	identIndex := make(map[string]*iam_pb.Identity, len(s3cfg.Identities))
+	for _, ident := range s3cfg.Identities {
+		identIndex[ident.Name] = ident
+	}
+	for _, memberName := range group.Members {
+		if ident, ok := identIndex[memberName]; ok {
+			aggregatedActions, err := computeAllActionsForUser(iama, memberName, policies, ident, s3cfg)
+			if err != nil {
+				glog.Warningf("Failed to recompute actions for user %s after group policy change: %v", memberName, err)
+			} else {
+				ident.Actions = aggregatedActions
+			}
+		}
+	}
+}

weed/iamapi/iamapi_handlers.go

@@ -0,0 +1,48 @@
+package iamapi
+
+import (
+	"net/http"
+
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+func newErrorResponse(errCode string, errMsg string, requestID string) ErrorResponse {
+	errorResp := ErrorResponse{}
+	errorResp.Error.Type = "Sender"
+	errorResp.Error.Code = &errCode
+	errorResp.Error.Message = &errMsg
+	errorResp.SetRequestId(requestID)
+	return errorResp
+}
+
+func writeIamErrorResponse(w http.ResponseWriter, r *http.Request, reqID string, iamError *IamError) {
+	if iamError == nil {
+		glog.Errorf("writeIamErrorResponse called with nil error")
+		internalResp := newErrorResponse(iam.ErrCodeServiceFailureException, "Internal server error", reqID)
+		s3err.WriteXMLResponse(w, r, http.StatusInternalServerError, internalResp)
+		return
+	}
+
+	errCode := iamError.Code
+	errMsg := iamError.Error.Error()
+	glog.Errorf("Response %+v", errMsg)
+
+	errorResp := newErrorResponse(errCode, errMsg, reqID)
+	internalErrorResponse := newErrorResponse(iam.ErrCodeServiceFailureException, "Internal server error", reqID)
+
+	switch errCode {
+	case iam.ErrCodeNoSuchEntityException:
+		s3err.WriteXMLResponse(w, r, http.StatusNotFound, errorResp)
+	case iam.ErrCodeMalformedPolicyDocumentException, iam.ErrCodeInvalidInputException:
+		s3err.WriteXMLResponse(w, r, http.StatusBadRequest, errorResp)
+	case iam.ErrCodeDeleteConflictException, iam.ErrCodeEntityAlreadyExistsException:
+		s3err.WriteXMLResponse(w, r, http.StatusConflict, errorResp)
+	case iam.ErrCodeServiceFailureException:
+		// We do not want to expose internal server error to the client
+		s3err.WriteXMLResponse(w, r, http.StatusInternalServerError, internalErrorResponse)
+	default:
+		s3err.WriteXMLResponse(w, r, http.StatusInternalServerError, internalErrorResponse)
+	}
+}

weed/iamapi/iamapi_management_handlers_test.go

@@ -0,0 +1,914 @@
+package iamapi
+
+import (
+	"encoding/json"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/arn"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/stretchr/testify/assert"
+)
+
+// mockIamS3ApiConfig is a mock for testing
+type mockIamS3ApiConfig struct {
+	policies Policies
+}
+
+func (m *mockIamS3ApiConfig) GetS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) (err error) {
+	return nil
+}
+
+func (m *mockIamS3ApiConfig) PutS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) (err error) {
+	return nil
+}
+
+func (m *mockIamS3ApiConfig) GetPolicies(policies *Policies) (err error) {
+	*policies = m.policies
+	if m.policies.Policies == nil {
+		return filer_pb.ErrNotFound
+	}
+	return nil
+}
+
+func (m *mockIamS3ApiConfig) PutPolicies(policies *Policies) (err error) {
+	m.policies = *policies
+	return nil
+}
+
+func TestGetActionsUserPath(t *testing.T) {
+
+	policyDocument := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:Put*", "s3:PutBucketAcl", "s3:Get*", "s3:GetBucketAcl", "s3:List*", "s3:Tagging*", "s3:DeleteBucket*"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::shared/user-Alice/*"),
+			},
+		},
+	}
+
+	actions, _ := GetActions(&policyDocument)
+
+	expectedActions := []string{
+		"Write:shared/user-Alice/*",
+		"WriteAcp:shared/user-Alice/*",
+		"Read:shared/user-Alice/*",
+		"ReadAcp:shared/user-Alice/*",
+		"List:shared/user-Alice/*",
+		"Tagging:shared/user-Alice/*",
+		"DeleteBucket:shared/user-Alice/*",
+	}
+	assert.Equal(t, expectedActions, actions)
+}
+
+func TestGetActionsWildcardPath(t *testing.T) {
+
+	policyDocument := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:Get*", "s3:PutBucketAcl"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::*"),
+			},
+		},
+	}
+
+	actions, _ := GetActions(&policyDocument)
+
+	expectedActions := []string{
+		"Read",
+		"WriteAcp",
+	}
+	assert.Equal(t, expectedActions, actions)
+}
+
+func TestGetActionsInvalidAction(t *testing.T) {
+	policyDocument := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:InvalidAction"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::shared/user-Alice/*"),
+			},
+		},
+	}
+
+	_, err := GetActions(&policyDocument)
+	assert.NotNil(t, err)
+	assert.Equal(t, "not a valid action: 'InvalidAction'", err.Error())
+}
+
+func TestPutGetUserPolicyPreservesStatements(t *testing.T) {
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	}
+	policyJSON := `{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:ListBucket",
+        "s3:GetBucketLocation"
+      ],
+      "Resource": [
+        "arn:aws:s3:::my-bucket/*",
+        "arn:aws:s3:::test/*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:PutObject"
+      ],
+      "Resource": [
+        "arn:aws:s3:::my-bucket/*",
+        "arn:aws:s3:::test/*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:DeleteObject"
+      ],
+      "Resource": [
+        "arn:aws:s3:::my-bucket/*",
+        "arn:aws:s3:::test/*"
+      ]
+    }
+  ]
+}`
+
+	iama := &IamApiServer{
+		s3ApiConfig: &mockIamS3ApiConfig{},
+	}
+	putValues := url.Values{
+		"UserName":       []string{"alice"},
+		"PolicyName":     []string{"inline-policy"},
+		"PolicyDocument": []string{policyJSON},
+	}
+	_, iamErr := iama.PutUserPolicy(s3cfg, putValues)
+	assert.Nil(t, iamErr)
+
+	getValues := url.Values{
+		"UserName":   []string{"alice"},
+		"PolicyName": []string{"inline-policy"},
+	}
+	resp, iamErr := iama.GetUserPolicy(s3cfg, getValues)
+	assert.Nil(t, iamErr)
+
+	// Verify that key policy properties are preserved (not merged or lost)
+	var got policy_engine.PolicyDocument
+	assert.NoError(t, json.Unmarshal([]byte(resp.GetUserPolicyResult.PolicyDocument), &got))
+
+	// Assert we have exactly 3 statements (not merged into 1 or lost)
+	assert.Equal(t, 3, len(got.Statement))
+
+	// Assert that DeleteObject statement is present (was lost in the bug)
+	deleteObjectFound := false
+	for _, stmt := range got.Statement {
+		if len(stmt.Action.Strings()) > 0 {
+			for _, action := range stmt.Action.Strings() {
+				if action == "s3:DeleteObject" {
+					deleteObjectFound = true
+					break
+				}
+			}
+		}
+	}
+	assert.True(t, deleteObjectFound, "s3:DeleteObject action was lost")
+}
+
+// TestPutGetUserPolicyIssue9008 is a regression test for
+// https://github.com/seaweedfs/seaweedfs/issues/9008: put-user-policy followed
+// by get-user-policy must return the same policy document that was submitted,
+// with Action and Resource lists intact (no duplication, no collapsing).
+func TestPutGetUserPolicyIssue9008(t *testing.T) {
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "steward"}},
+	}
+	policyJSON := `{
+    "Version": "2012-10-17",
+    "Statement": [{
+      "Effect": "Allow",
+      "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
+      "Resource": ["arn:aws:s3:::b-le*", "arn:aws:s3:::b-le*/*"]
+    }]
+  }`
+
+	mockCfg := &mockIamS3ApiConfig{}
+	iama := &IamApiServer{s3ApiConfig: mockCfg}
+	_, iamErr := iama.PutUserPolicy(s3cfg, url.Values{
+		"UserName":       []string{"steward"},
+		"PolicyName":     []string{"steward_policy"},
+		"PolicyDocument": []string{policyJSON},
+	})
+	assert.Nil(t, iamErr)
+
+	// Part 1: verbatim round-trip. GetUserPolicy returns the exact document
+	// that was persisted, with Action and Resource lists intact.
+	resp, iamErr := iama.GetUserPolicy(s3cfg, url.Values{
+		"UserName":   []string{"steward"},
+		"PolicyName": []string{"steward_policy"},
+	})
+	assert.Nil(t, iamErr)
+
+	var got policy_engine.PolicyDocument
+	assert.NoError(t, json.Unmarshal([]byte(resp.GetUserPolicyResult.PolicyDocument), &got))
+
+	assert.Equal(t, "2012-10-17", got.Version)
+	assert.Equal(t, 1, len(got.Statement))
+	stmt := got.Statement[0]
+	assert.Equal(t, policy_engine.PolicyEffectAllow, stmt.Effect)
+	assert.ElementsMatch(t, []string{"s3:GetObject", "s3:PutObject", "s3:ListBucket"}, stmt.Action.Strings())
+	assert.ElementsMatch(t, []string{"arn:aws:s3:::b-le*", "arn:aws:s3:::b-le*/*"}, stmt.Resource.Strings())
+
+	// Part 2: fallback reconstruction. Clear the persisted inline policy so
+	// GetUserPolicy must rebuild the document from ident.Actions. The fallback
+	// is lossy (distinct S3 verbs collapse to wildcards like s3:Get*), but it
+	// must not duplicate actions nor conflate bucket-level and object-level
+	// resources.
+	mockCfg.policies = Policies{}
+
+	resp, iamErr = iama.GetUserPolicy(s3cfg, url.Values{
+		"UserName":   []string{"steward"},
+		"PolicyName": []string{"steward_policy"},
+	})
+	assert.Nil(t, iamErr)
+
+	var fallback policy_engine.PolicyDocument
+	assert.NoError(t, json.Unmarshal([]byte(resp.GetUserPolicyResult.PolicyDocument), &fallback))
+	assert.Equal(t, 1, len(fallback.Statement), "fallback should merge equal-action statements")
+	fstmt := fallback.Statement[0]
+
+	// Each coarse verb appears exactly once (no duplication from the
+	// Read/Write/List -> s3:Get*/s3:Put*/s3:List* expansion).
+	assert.ElementsMatch(t, []string{"s3:Get*", "s3:Put*", "s3:List*"}, fstmt.Action.Strings())
+
+	// Bucket-level and object-level resources stay distinct — the bare bucket
+	// pattern must not be rewritten to an object ARN.
+	assert.ElementsMatch(t, []string{"arn:aws:s3:::b-le*", "arn:aws:s3:::b-le*/*"}, fstmt.Resource.Strings())
+}
+
+func TestMultipleInlinePoliciesAggregateActions(t *testing.T) {
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	}
+
+	policy1JSON := `{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:GetObject", "s3:ListBucket"],
+      "Resource": ["arn:aws:s3:::bucket-a/*"]
+    }
+  ]
+}`
+
+	policy2JSON := `{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:PutObject"],
+      "Resource": ["arn:aws:s3:::bucket-b/*"]
+    }
+  ]
+}`
+
+	iama := &IamApiServer{
+		s3ApiConfig: &mockIamS3ApiConfig{},
+	}
+
+	// Put first inline policy
+	putValues1 := url.Values{
+		"UserName":       []string{"alice"},
+		"PolicyName":     []string{"policy-read"},
+		"PolicyDocument": []string{policy1JSON},
+	}
+	_, iamErr := iama.PutUserPolicy(s3cfg, putValues1)
+	assert.Nil(t, iamErr)
+
+	// Check that alice's actions include read operations
+	aliceIdent := s3cfg.Identities[0]
+	assert.Greater(t, len(aliceIdent.Actions), 0, "Actions should not be empty after first policy")
+
+	// Put second inline policy
+	putValues2 := url.Values{
+		"UserName":       []string{"alice"},
+		"PolicyName":     []string{"policy-write"},
+		"PolicyDocument": []string{policy2JSON},
+	}
+	_, iamErr = iama.PutUserPolicy(s3cfg, putValues2)
+	assert.Nil(t, iamErr)
+
+	// Check that alice now has aggregated actions from both policies
+	// Should include Read and List (from policy1) and Write (from policy2)
+	// with resource paths indicating which policy they came from
+
+	// Build a set of actual action strings for exact membership checks
+	actionSet := make(map[string]bool)
+	for _, action := range aliceIdent.Actions {
+		actionSet[action] = true
+	}
+
+	// Expected actions from both policies:
+	// - policy1: GetObject, ListBucket on bucket-a/*  → "Read:bucket-a/*", "List:bucket-a/*"
+	// - policy2: PutObject on bucket-b/*  → "Write:bucket-b/*"
+	expectedActions := []string{
+		"Read:bucket-a/*",
+		"List:bucket-a/*",
+		"Write:bucket-b/*",
+	}
+
+	for _, expectedAction := range expectedActions {
+		assert.True(t, actionSet[expectedAction], "Expected action '%s' not found in aggregated actions. Got: %v", expectedAction, aliceIdent.Actions)
+	}
+}
+
+// newTestIamApiServer creates a minimal IamApiServer for unit testing with only s3ApiConfig set.
+// Other fields (iam, masterClient, etc.) are left nil — tests must not call code paths that use them.
+func newTestIamApiServer(policies Policies) *IamApiServer {
+	return &IamApiServer{
+		s3ApiConfig: &mockIamS3ApiConfig{policies: policies},
+	}
+}
+
+func TestGetPolicy(t *testing.T) {
+	policyDoc := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::*"),
+			},
+		},
+	}
+	iama := newTestIamApiServer(Policies{
+		Policies: map[string]policy_engine.PolicyDocument{"my-policy": policyDoc},
+	})
+	s3cfg := &iam_pb.S3ApiConfiguration{}
+
+	// Success case
+	values := url.Values{"PolicyArn": []string{"arn:aws:iam:::policy/my-policy"}}
+	resp, iamErr := iama.GetPolicy(s3cfg, values)
+	assert.Nil(t, iamErr)
+	assert.Equal(t, "my-policy", *resp.GetPolicyResult.Policy.PolicyName)
+	assert.Equal(t, "arn:aws:iam:::policy/my-policy", *resp.GetPolicyResult.Policy.Arn)
+	policyName := "my-policy"
+	expectedId := Hash(&policyName)
+	assert.Equal(t, expectedId, *resp.GetPolicyResult.Policy.PolicyId)
+
+	// Not found case
+	values = url.Values{"PolicyArn": []string{"arn:aws:iam:::policy/nonexistent"}}
+	_, iamErr = iama.GetPolicy(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeNoSuchEntityException, iamErr.Code)
+
+	// Invalid ARN
+	values = url.Values{"PolicyArn": []string{"invalid-arn"}}
+	_, iamErr = iama.GetPolicy(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+
+	// Empty ARN
+	values = url.Values{"PolicyArn": []string{""}}
+	_, iamErr = iama.GetPolicy(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+}
+
+func TestDeletePolicy(t *testing.T) {
+	policyDoc := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::*"),
+			},
+		},
+	}
+	mock := &mockIamS3ApiConfig{policies: Policies{
+		Policies: map[string]policy_engine.PolicyDocument{"my-policy": policyDoc},
+	}}
+	iama := &IamApiServer{s3ApiConfig: mock}
+
+	// Reject deletion when policy is attached to a user (AWS-compatible behavior)
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{
+			Name:        "alice",
+			PolicyNames: []string{"my-policy"},
+		}},
+	}
+	values := url.Values{"PolicyArn": []string{"arn:aws:iam:::policy/my-policy"}}
+	_, iamErr := iama.DeletePolicy(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeDeleteConflictException, iamErr.Code)
+
+	// Succeed when no users are attached
+	s3cfgEmpty := &iam_pb.S3ApiConfiguration{}
+	_, iamErr = iama.DeletePolicy(s3cfgEmpty, values)
+	assert.Nil(t, iamErr)
+
+	// Verify deleted
+	_, iamErr = iama.GetPolicy(s3cfgEmpty, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeNoSuchEntityException, iamErr.Code)
+}
+
+func TestListPolicies(t *testing.T) {
+	iama := newTestIamApiServer(Policies{})
+	s3cfg := &iam_pb.S3ApiConfiguration{}
+
+	// Empty case
+	resp, iamErr := iama.ListPolicies(s3cfg, url.Values{})
+	assert.Nil(t, iamErr)
+	assert.Empty(t, resp.ListPoliciesResult.Policies)
+
+	// Populated case
+	policyDoc := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::*"),
+			},
+		},
+	}
+	iama = newTestIamApiServer(Policies{
+		Policies: map[string]policy_engine.PolicyDocument{
+			"policy-a": policyDoc,
+			"policy-b": policyDoc,
+		},
+	})
+
+	resp, iamErr = iama.ListPolicies(s3cfg, url.Values{})
+	assert.Nil(t, iamErr)
+	assert.Equal(t, 2, len(resp.ListPoliciesResult.Policies))
+	for _, p := range resp.ListPoliciesResult.Policies {
+		name := *p.PolicyName
+		expectedId := Hash(&name)
+		assert.Equal(t, expectedId, *p.PolicyId, "PolicyId should be Hash(policyName) for %s", name)
+	}
+}
+
+func TestAttachUserPolicy(t *testing.T) {
+	policyDoc := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::*"),
+			},
+		},
+	}
+	iama := newTestIamApiServer(Policies{
+		Policies: map[string]policy_engine.PolicyDocument{"my-policy": policyDoc},
+	})
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	}
+
+	// Success case
+	values := url.Values{
+		"UserName":  []string{"alice"},
+		"PolicyArn": []string{"arn:aws:iam:::policy/my-policy"},
+	}
+	_, iamErr := iama.AttachUserPolicy(s3cfg, values)
+	assert.Nil(t, iamErr)
+	assert.Contains(t, s3cfg.Identities[0].PolicyNames, "my-policy")
+	// Verify actions were computed from the managed policy
+	assert.Greater(t, len(s3cfg.Identities[0].Actions), 0)
+
+	// Idempotent re-attach
+	_, iamErr = iama.AttachUserPolicy(s3cfg, values)
+	assert.Nil(t, iamErr)
+	// Should still have exactly one entry
+	count := 0
+	for _, name := range s3cfg.Identities[0].PolicyNames {
+		if name == "my-policy" {
+			count++
+		}
+	}
+	assert.Equal(t, 1, count)
+
+	// Policy not found
+	values = url.Values{
+		"UserName":  []string{"alice"},
+		"PolicyArn": []string{"arn:aws:iam:::policy/nonexistent"},
+	}
+	_, iamErr = iama.AttachUserPolicy(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeNoSuchEntityException, iamErr.Code)
+
+	// User not found
+	values = url.Values{
+		"UserName":  []string{"bob"},
+		"PolicyArn": []string{"arn:aws:iam:::policy/my-policy"},
+	}
+	_, iamErr = iama.AttachUserPolicy(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeNoSuchEntityException, iamErr.Code)
+}
+
+func TestManagedPolicyActionsPreservedAcrossInlineMutations(t *testing.T) {
+	managedPolicyDoc := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::*"),
+			},
+		},
+	}
+	iama := newTestIamApiServer(Policies{
+		Policies: map[string]policy_engine.PolicyDocument{"my-policy": managedPolicyDoc},
+	})
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	}
+
+	// Attach managed policy
+	_, iamErr := iama.AttachUserPolicy(s3cfg, url.Values{
+		"UserName":  []string{"alice"},
+		"PolicyArn": []string{"arn:aws:iam:::policy/my-policy"},
+	})
+	assert.Nil(t, iamErr)
+	assert.Contains(t, s3cfg.Identities[0].Actions, "Read", "Managed policy should grant Read action")
+
+	// Add an inline policy
+	inlinePolicyJSON := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-x/*"}]}`
+	_, iamErr = iama.PutUserPolicy(s3cfg, url.Values{
+		"UserName":       []string{"alice"},
+		"PolicyName":     []string{"inline-write"},
+		"PolicyDocument": []string{inlinePolicyJSON},
+	})
+	assert.Nil(t, iamErr)
+
+	// Should have both managed (Read) and inline (Write:bucket-x/*) actions
+	actionSet := make(map[string]bool)
+	for _, a := range s3cfg.Identities[0].Actions {
+		actionSet[a] = true
+	}
+	assert.True(t, actionSet["Read"], "Managed policy Read action should persist after PutUserPolicy")
+	assert.True(t, actionSet["Write:bucket-x/*"], "Inline policy Write action should be present")
+
+	// Delete the inline policy
+	_, iamErr = iama.DeleteUserPolicy(s3cfg, url.Values{
+		"UserName":   []string{"alice"},
+		"PolicyName": []string{"inline-write"},
+	})
+	assert.Nil(t, iamErr)
+
+	// Managed policy actions should still be present
+	assert.Contains(t, s3cfg.Identities[0].PolicyNames, "my-policy", "Managed policy should still be attached")
+	assert.Contains(t, s3cfg.Identities[0].Actions, "Read", "Managed policy Read action should persist after DeleteUserPolicy")
+}
+
+func TestDetachUserPolicy(t *testing.T) {
+	policyDoc := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::*"),
+			},
+		},
+	}
+	iama := newTestIamApiServer(Policies{
+		Policies: map[string]policy_engine.PolicyDocument{"my-policy": policyDoc},
+	})
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice", PolicyNames: []string{"my-policy"}}},
+	}
+
+	values := url.Values{
+		"UserName":  []string{"alice"},
+		"PolicyArn": []string{"arn:aws:iam:::policy/my-policy"},
+	}
+	_, iamErr := iama.DetachUserPolicy(s3cfg, values)
+	assert.Nil(t, iamErr)
+	assert.Empty(t, s3cfg.Identities[0].PolicyNames)
+
+	// Detach again should fail (not attached)
+	_, iamErr = iama.DetachUserPolicy(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeNoSuchEntityException, iamErr.Code)
+}
+
+func TestListAttachedUserPolicies(t *testing.T) {
+	iama := newTestIamApiServer(Policies{})
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice", PolicyNames: []string{"policy-a", "policy-b"}}},
+	}
+
+	values := url.Values{"UserName": []string{"alice"}}
+	resp, iamErr := iama.ListAttachedUserPolicies(s3cfg, values)
+	assert.Nil(t, iamErr)
+	assert.Equal(t, 2, len(resp.ListAttachedUserPoliciesResult.AttachedPolicies))
+	assert.Equal(t, "policy-a", *resp.ListAttachedUserPoliciesResult.AttachedPolicies[0].PolicyName)
+	assert.Equal(t, "arn:aws:iam:::policy/policy-a", *resp.ListAttachedUserPoliciesResult.AttachedPolicies[0].PolicyArn)
+
+	// User not found
+	values = url.Values{"UserName": []string{"bob"}}
+	_, iamErr = iama.ListAttachedUserPolicies(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeNoSuchEntityException, iamErr.Code)
+}
+
+// TestUserArnIsValid is a regression test for issue #9786: the terraform aws
+// provider (>= 6.41) reads a user back after creating it and blocks until
+// GetUser returns a value that passes arn.IsARN.
+func TestUserArnIsValid(t *testing.T) {
+	iama := newTestIamApiServer(Policies{})
+	s3cfg := &iam_pb.S3ApiConfiguration{}
+
+	createResp := iama.CreateUser(s3cfg, url.Values{"UserName": []string{"alice"}})
+	assert.True(t, arn.IsARN(aws.StringValue(createResp.CreateUserResult.User.Arn)),
+		"CreateUser must return a valid ARN, got %q", aws.StringValue(createResp.CreateUserResult.User.Arn))
+
+	getResp, iamErr := iama.GetUser(s3cfg, "alice")
+	assert.Nil(t, iamErr)
+	assert.True(t, arn.IsARN(aws.StringValue(getResp.GetUserResult.User.Arn)),
+		"GetUser must return a valid ARN, got %q", aws.StringValue(getResp.GetUserResult.User.Arn))
+}
+
+func TestCreateAccessKeyWithCallerSuppliedKeys(t *testing.T) {
+	iama := newTestIamApiServer(Policies{})
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	}
+	values := url.Values{
+		"UserName":       []string{"alice"},
+		"AccessKeyId":    []string{"myappkey"},
+		"SecretAccessKey": []string{"mysecret1234"},
+	}
+	resp, iamErr := iama.CreateAccessKey(s3cfg, values)
+	assert.Nil(t, iamErr)
+	assert.Equal(t, "myappkey", *resp.CreateAccessKeyResult.AccessKey.AccessKeyId)
+	assert.Equal(t, "mysecret1234", *resp.CreateAccessKeyResult.AccessKey.SecretAccessKey)
+	assert.Equal(t, "alice", *resp.CreateAccessKeyResult.AccessKey.UserName)
+	assert.Equal(t, "myappkey", s3cfg.Identities[0].Credentials[0].AccessKey)
+	assert.Equal(t, "mysecret1234", s3cfg.Identities[0].Credentials[0].SecretKey)
+}
+
+func TestCreateAccessKeyRandomGeneration(t *testing.T) {
+	iama := newTestIamApiServer(Policies{})
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	}
+	values := url.Values{
+		"UserName": []string{"alice"},
+	}
+	resp, iamErr := iama.CreateAccessKey(s3cfg, values)
+	assert.Nil(t, iamErr)
+	assert.NotEmpty(t, *resp.CreateAccessKeyResult.AccessKey.AccessKeyId)
+	assert.NotEmpty(t, *resp.CreateAccessKeyResult.AccessKey.SecretAccessKey)
+	assert.Len(t, s3cfg.Identities[0].Credentials, 1)
+}
+
+func TestCreateAccessKeyRejectsWeakKeys(t *testing.T) {
+	iama := newTestIamApiServer(Policies{})
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	}
+	// Too short
+	values := url.Values{
+		"UserName":       []string{"alice"},
+		"AccessKeyId":    []string{"ab"},
+		"SecretAccessKey": []string{"validsecret1"},
+	}
+	_, iamErr := iama.CreateAccessKey(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+
+	// Short secret
+	values = url.Values{
+		"UserName":       []string{"alice"},
+		"AccessKeyId":    []string{"validkey"},
+		"SecretAccessKey": []string{"short"},
+	}
+	_, iamErr = iama.CreateAccessKey(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+
+	// SigV4 delimiters
+	values = url.Values{
+		"UserName":       []string{"alice"},
+		"AccessKeyId":    []string{"foo/bar=baz"},
+		"SecretAccessKey": []string{"validsecret1"},
+	}
+	_, iamErr = iama.CreateAccessKey(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+}
+
+func TestCreateAccessKeyRejectsCollision(t *testing.T) {
+	iama := newTestIamApiServer(Policies{})
+	// Use a distinctive owner name ("ownerAlpha") that shares no substring
+	// with the expected error message so the leak assertion is meaningful.
+	const ownerName = "ownerAlpha"
+
+	t.Run("identity credential", func(t *testing.T) {
+		s3cfg := &iam_pb.S3ApiConfiguration{
+			Identities: []*iam_pb.Identity{
+				{
+					Name: ownerName,
+					Credentials: []*iam_pb.Credential{
+						{AccessKey: "takenkey", SecretKey: "existingsecret"},
+					},
+				},
+				{Name: "newuser"},
+			},
+		}
+		values := url.Values{
+			"UserName":        []string{"newuser"},
+			"AccessKeyId":     []string{"takenkey"},
+			"SecretAccessKey": []string{"newsecret123"},
+		}
+		_, iamErr := iama.CreateAccessKey(s3cfg, values)
+		assert.NotNil(t, iamErr)
+		assert.Equal(t, iam.ErrCodeEntityAlreadyExistsException, iamErr.Code)
+		assert.NotContains(t, iamErr.Error.Error(), ownerName, "should not leak owner name")
+		assert.Len(t, s3cfg.Identities[1].Credentials, 0)
+	})
+
+	t.Run("service account credential", func(t *testing.T) {
+		const saId = "svcAlpha"
+		s3cfg := &iam_pb.S3ApiConfiguration{
+			Identities: []*iam_pb.Identity{
+				{Name: "newuser"},
+			},
+			ServiceAccounts: []*iam_pb.ServiceAccount{
+				{
+					Id:         saId,
+					Credential: &iam_pb.Credential{AccessKey: "takenkey", SecretKey: "existingsecret"},
+				},
+			},
+		}
+		values := url.Values{
+			"UserName":        []string{"newuser"},
+			"AccessKeyId":     []string{"takenkey"},
+			"SecretAccessKey": []string{"newsecret123"},
+		}
+		_, iamErr := iama.CreateAccessKey(s3cfg, values)
+		assert.NotNil(t, iamErr)
+		assert.Equal(t, iam.ErrCodeEntityAlreadyExistsException, iamErr.Code)
+		assert.NotContains(t, iamErr.Error.Error(), saId, "should not leak owner id")
+		// The service account's existing credential must be untouched, and
+		// no new credential should be attached to the identity.
+		assert.Equal(t, "takenkey", s3cfg.ServiceAccounts[0].Credential.AccessKey)
+		assert.Equal(t, "existingsecret", s3cfg.ServiceAccounts[0].Credential.SecretKey)
+		assert.Len(t, s3cfg.Identities[0].Credentials, 0)
+	})
+}
+
+func TestCreateAccessKeyBoundary(t *testing.T) {
+	iama := newTestIamApiServer(Policies{})
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	}
+	// Exactly 4 chars - should pass
+	values := url.Values{
+		"UserName":        []string{"alice"},
+		"AccessKeyId":     []string{"abcd"},
+		"SecretAccessKey": []string{"secretkey123"},
+	}
+	resp, iamErr := iama.CreateAccessKey(s3cfg, values)
+	assert.Nil(t, iamErr)
+	assert.Equal(t, "abcd", *resp.CreateAccessKeyResult.AccessKey.AccessKeyId)
+
+	// Exactly 3 chars - should fail
+	s3cfg.Identities[0].Credentials = nil
+	values = url.Values{
+		"UserName":        []string{"alice"},
+		"AccessKeyId":     []string{"abc"},
+		"SecretAccessKey": []string{"secretkey123"},
+	}
+	_, iamErr = iama.CreateAccessKey(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+
+	// Exactly 128 chars - should pass
+	s3cfg.Identities[0].Credentials = nil
+	ak128 := strings.Repeat("a", 128)
+	sk128 := strings.Repeat("s", 128)
+	values = url.Values{
+		"UserName":        []string{"alice"},
+		"AccessKeyId":     []string{ak128},
+		"SecretAccessKey": []string{sk128},
+	}
+	resp, iamErr = iama.CreateAccessKey(s3cfg, values)
+	assert.Nil(t, iamErr)
+	assert.Equal(t, ak128, *resp.CreateAccessKeyResult.AccessKey.AccessKeyId)
+	assert.Equal(t, sk128, *resp.CreateAccessKeyResult.AccessKey.SecretAccessKey)
+
+	// 129 chars AccessKeyId - should fail
+	s3cfg.Identities[0].Credentials = nil
+	values = url.Values{
+		"UserName":        []string{"alice"},
+		"AccessKeyId":     []string{strings.Repeat("a", 129)},
+		"SecretAccessKey": []string{sk128},
+	}
+	_, iamErr = iama.CreateAccessKey(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+
+	// 7-char SecretAccessKey - should fail
+	s3cfg.Identities[0].Credentials = nil
+	values = url.Values{
+		"UserName":        []string{"alice"},
+		"AccessKeyId":     []string{"validkey"},
+		"SecretAccessKey": []string{"1234567"},
+	}
+	_, iamErr = iama.CreateAccessKey(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+
+	// Exactly 8-char SecretAccessKey - should pass (lower boundary)
+	s3cfg.Identities[0].Credentials = nil
+	values = url.Values{
+		"UserName":        []string{"alice"},
+		"AccessKeyId":     []string{"validkey"},
+		"SecretAccessKey": []string{"12345678"},
+	}
+	resp, iamErr = iama.CreateAccessKey(s3cfg, values)
+	assert.Nil(t, iamErr)
+	assert.Equal(t, "12345678", *resp.CreateAccessKeyResult.AccessKey.SecretAccessKey)
+
+	// 129-char SecretAccessKey - should fail
+	s3cfg.Identities[0].Credentials = nil
+	values = url.Values{
+		"UserName":        []string{"alice"},
+		"AccessKeyId":     []string{"validkey"},
+		"SecretAccessKey": []string{strings.Repeat("s", 129)},
+	}
+	_, iamErr = iama.CreateAccessKey(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+}
+
+func TestCreateAccessKeyRejectsPartialSupply(t *testing.T) {
+	iama := newTestIamApiServer(Policies{})
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	}
+	// AccessKeyId supplied, SecretAccessKey omitted
+	values := url.Values{
+		"UserName":    []string{"alice"},
+		"AccessKeyId": []string{"myappkey"},
+	}
+	_, iamErr := iama.CreateAccessKey(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+	assert.Len(t, s3cfg.Identities[0].Credentials, 0)
+
+	// SecretAccessKey supplied, AccessKeyId omitted
+	values = url.Values{
+		"UserName":        []string{"alice"},
+		"SecretAccessKey": []string{"secretkey123"},
+	}
+	_, iamErr = iama.CreateAccessKey(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+	assert.Len(t, s3cfg.Identities[0].Credentials, 0)
+
+	// Partial supply wins over collision: only AccessKeyId supplied, and
+	// it matches an existing credential. We must see InvalidInput, not
+	// EntityAlreadyExists — the both-or-none rule is more fundamental.
+	s3cfg = &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{
+			{
+				Name: "ownerAlpha",
+				Credentials: []*iam_pb.Credential{
+					{AccessKey: "takenkey", SecretKey: "s"},
+				},
+			},
+			{Name: "alice"},
+		},
+	}
+	values = url.Values{
+		"UserName":    []string{"alice"},
+		"AccessKeyId": []string{"takenkey"},
+	}
+	_, iamErr = iama.CreateAccessKey(s3cfg, values)
+	assert.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeInvalidInputException, iamErr.Code)
+}

weed/iamapi/iamapi_response.go

@@ -0,0 +1,60 @@
+package iamapi
+
+// This file re-exports IAM response types from the shared weed/iam package
+// for backwards compatibility with existing code.
+
+import (
+	iamlib "github.com/seaweedfs/seaweedfs/weed/iam"
+)
+
+// Type aliases for IAM response types from shared package
+type (
+	CommonResponse                   = iamlib.CommonResponse
+	ListUsersResponse                = iamlib.ListUsersResponse
+	ListAccessKeysResponse           = iamlib.ListAccessKeysResponse
+	DeleteAccessKeyResponse          = iamlib.DeleteAccessKeyResponse
+	CreatePolicyResponse             = iamlib.CreatePolicyResponse
+	CreateUserResponse               = iamlib.CreateUserResponse
+	DeleteUserResponse               = iamlib.DeleteUserResponse
+	GetUserResponse                  = iamlib.GetUserResponse
+	UpdateUserResponse               = iamlib.UpdateUserResponse
+	CreateAccessKeyResponse          = iamlib.CreateAccessKeyResponse
+	UpdateAccessKeyResponse          = iamlib.UpdateAccessKeyResponse
+	PutUserPolicyResponse            = iamlib.PutUserPolicyResponse
+	DeleteUserPolicyResponse         = iamlib.DeleteUserPolicyResponse
+	GetUserPolicyResponse            = iamlib.GetUserPolicyResponse
+	ListUserPoliciesResponse         = iamlib.ListUserPoliciesResponse
+	GetPolicyResponse                = iamlib.GetPolicyResponse
+	DeletePolicyResponse             = iamlib.DeletePolicyResponse
+	ListPoliciesResponse             = iamlib.ListPoliciesResponse
+	ListPolicyVersionsResponse       = iamlib.ListPolicyVersionsResponse
+	GetPolicyVersionResponse         = iamlib.GetPolicyVersionResponse
+	CreatePolicyVersionResponse      = iamlib.CreatePolicyVersionResponse
+	DeletePolicyVersionResponse      = iamlib.DeletePolicyVersionResponse
+	AttachUserPolicyResponse         = iamlib.AttachUserPolicyResponse
+	DetachUserPolicyResponse         = iamlib.DetachUserPolicyResponse
+	ListAttachedUserPoliciesResponse = iamlib.ListAttachedUserPoliciesResponse
+	ErrorResponse                    = iamlib.ErrorResponse
+	ServiceAccountInfo               = iamlib.ServiceAccountInfo
+	CreateServiceAccountResponse     = iamlib.CreateServiceAccountResponse
+	DeleteServiceAccountResponse     = iamlib.DeleteServiceAccountResponse
+	ListServiceAccountsResponse      = iamlib.ListServiceAccountsResponse
+	GetServiceAccountResponse        = iamlib.GetServiceAccountResponse
+	UpdateServiceAccountResponse     = iamlib.UpdateServiceAccountResponse
+	// Group response types
+	CreateGroupResponse               = iamlib.CreateGroupResponse
+	DeleteGroupResponse               = iamlib.DeleteGroupResponse
+	UpdateGroupResponse               = iamlib.UpdateGroupResponse
+	GetGroupResponse                  = iamlib.GetGroupResponse
+	ListGroupsResponse                = iamlib.ListGroupsResponse
+	AddUserToGroupResponse            = iamlib.AddUserToGroupResponse
+	RemoveUserFromGroupResponse       = iamlib.RemoveUserFromGroupResponse
+	AttachGroupPolicyResponse         = iamlib.AttachGroupPolicyResponse
+	DetachGroupPolicyResponse         = iamlib.DetachGroupPolicyResponse
+	ListAttachedGroupPoliciesResponse = iamlib.ListAttachedGroupPoliciesResponse
+	PutGroupPolicyResponse            = iamlib.PutGroupPolicyResponse
+	GetGroupPolicyResponse            = iamlib.GetGroupPolicyResponse
+	DeleteGroupPolicyResponse         = iamlib.DeleteGroupPolicyResponse
+	ListGroupPoliciesResponse         = iamlib.ListGroupPoliciesResponse
+	ListGroupsForUserResponse         = iamlib.ListGroupsForUserResponse
+)

weed/iamapi/iamapi_server.go

@@ -0,0 +1,451 @@
+package iamapi
+
+// https://docs.aws.amazon.com/cli/latest/reference/iam/list-roles.html
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"reflect"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
+	"github.com/seaweedfs/seaweedfs/weed/util/request_id"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/proto"
+)
+
+type IamS3ApiConfig interface {
+	GetS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) (err error)
+	PutS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) (err error)
+	GetPolicies(policies *Policies) (err error)
+	PutPolicies(policies *Policies) (err error)
+}
+
+type IamS3ApiConfigure struct {
+	option            *IamServerOption
+	masterClient      *wdclient.MasterClient
+	credentialManager *credential.CredentialManager
+}
+
+type IamServerOption struct {
+	Masters        map[string]pb.ServerAddress
+	Filers         []pb.ServerAddress
+	Port           int
+	GrpcDialOption grpc.DialOption
+}
+
+type IamApiServer struct {
+	s3ApiConfig     IamS3ApiConfig
+	iam             *s3api.IdentityAccessManagement
+	shutdownContext context.Context
+	shutdownCancel  context.CancelFunc
+	masterClient    *wdclient.MasterClient
+}
+
+var s3ApiConfigure IamS3ApiConfig
+
+func NewIamApiServer(router *mux.Router, option *IamServerOption) (iamApiServer *IamApiServer, err error) {
+	return NewIamApiServerWithStore(router, option, "")
+}
+
+func NewIamApiServerWithStore(router *mux.Router, option *IamServerOption, explicitStore string) (iamApiServer *IamApiServer, err error) {
+	if len(option.Filers) == 0 {
+		return nil, fmt.Errorf("at least one filer address is required")
+	}
+
+	masterClient := wdclient.NewMasterClient(option.GrpcDialOption, "", "iam", "", "", "", *pb.NewServiceDiscoveryFromMap(option.Masters))
+
+	// Create a cancellable context for the master client connection
+	// This allows graceful shutdown via Shutdown() method
+	shutdownCtx, shutdownCancel := context.WithCancel(context.Background())
+
+	// Start KeepConnectedToMaster for volume location lookups
+	// IAM config files are typically small and inline, but if they ever have chunks,
+	// ReadEntry→StreamContent needs masterClient for volume lookups
+	glog.V(0).Infof("IAM API starting master client connection for volume location lookups")
+	go masterClient.KeepConnectedToMaster(shutdownCtx)
+
+	configure := &IamS3ApiConfigure{
+		option:       option,
+		masterClient: masterClient,
+	}
+
+	s3ApiConfigure = configure
+
+	s3Option := s3api.S3ApiServerOption{
+		Filers:         option.Filers,
+		GrpcDialOption: option.GrpcDialOption,
+	}
+
+	// Initialize FilerClient for IAM - explicit filers only (no discovery as FilerGroup unspecified)
+	filerClient := wdclient.NewFilerClient(option.Filers, option.GrpcDialOption, "")
+	iam := s3api.NewIdentityAccessManagementWithStore(&s3Option, filerClient, explicitStore)
+	configure.credentialManager = iam.GetCredentialManager()
+
+	iamApiServer = &IamApiServer{
+		s3ApiConfig:     s3ApiConfigure,
+		iam:             iam,
+		shutdownContext: shutdownCtx,
+		shutdownCancel:  shutdownCancel,
+		masterClient:    masterClient,
+	}
+
+	// Keep attempting to load configuration from filer now that we have a client
+	go func() {
+		if err := iam.LoadS3ApiConfigurationFromCredentialManager(); err != nil {
+			glog.Warningf("Failed to load IAM config from credential manager after client update: %v", err)
+		}
+	}()
+
+	iamApiServer.registerRouter(router)
+
+	return iamApiServer, nil
+}
+
+func (iama *IamApiServer) registerRouter(router *mux.Router) {
+	// SigV4 recomputes the canonical query from the parsed query, so raw ';'
+	// pairs that Go would drop must be recovered before verification.
+	router.Use(util_http.EscapeSemicolonsInQuery)
+	// API Router
+	apiRouter := router.PathPrefix("/").Subrouter()
+	apiRouter.Use(request_id.Middleware)
+	apiRouter.Methods(http.MethodPost).Path("/").HandlerFunc(iama.iam.AuthIamManagement(iama.DoActions))
+
+	// Health probes
+	apiRouter.Methods(http.MethodGet, http.MethodHead).Path("/healthz").HandlerFunc(iama.healthzHandler)
+	apiRouter.Methods(http.MethodGet, http.MethodHead).Path("/readyz").HandlerFunc(iama.readyzHandler)
+
+	// NotFound
+	apiRouter.NotFoundHandler = http.HandlerFunc(s3err.NotFoundHandler)
+}
+
+func (iama *IamApiServer) healthzHandler(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusOK)
+}
+
+func (iama *IamApiServer) readyzHandler(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusOK)
+}
+
+// Shutdown gracefully stops the IAM API server and releases resources.
+// It cancels the master client connection goroutine and closes gRPC connections.
+// This method is safe to call multiple times.
+//
+// Note: This method is called via defer in weed/command/iam.go for best-effort cleanup.
+// For proper graceful shutdown on SIGTERM/SIGINT, signal handling should be added to
+// the command layer to call this method before process exit.
+func (iama *IamApiServer) Shutdown() {
+	if iama.shutdownCancel != nil {
+		glog.V(0).Infof("IAM API server shutting down, stopping master client connection")
+		iama.shutdownCancel()
+	}
+	if iama.iam != nil {
+		iama.iam.Shutdown()
+	}
+}
+
+func (iama *IamS3ApiConfigure) GetS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) (err error) {
+	return iama.GetS3ApiConfigurationFromCredentialManager(s3cfg)
+}
+
+func (iama *IamS3ApiConfigure) PutS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) (err error) {
+	return iama.PutS3ApiConfigurationToCredentialManager(s3cfg)
+}
+
+func (iama *IamS3ApiConfigure) GetS3ApiConfigurationFromCredentialManager(s3cfg *iam_pb.S3ApiConfiguration) (err error) {
+	config, err := iama.credentialManager.LoadConfiguration(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to load configuration from credential manager: %w", err)
+	}
+	// Use proto.Merge to avoid copying the sync.Mutex embedded in the message
+	proto.Merge(s3cfg, config)
+	return nil
+}
+
+func (iama *IamS3ApiConfigure) PutS3ApiConfigurationToCredentialManager(s3cfg *iam_pb.S3ApiConfiguration) (err error) {
+	return iama.credentialManager.SaveConfiguration(context.Background(), s3cfg)
+}
+
+func (iama *IamS3ApiConfigure) GetS3ApiConfigurationFromFiler(s3cfg *iam_pb.S3ApiConfiguration) (err error) {
+	var buf bytes.Buffer
+	err = pb.WithOneOfGrpcFilerClients(false, iama.option.Filers, iama.option.GrpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+		if err = filer.ReadEntry(iama.masterClient, client, filer.IamConfigDirectory, filer.IamIdentityFile, &buf); err != nil {
+			return err
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+	if buf.Len() > 0 {
+		if err = filer.ParseS3ConfigurationFromBytes(buf.Bytes(), s3cfg); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (iama *IamS3ApiConfigure) PutS3ApiConfigurationToFiler(s3cfg *iam_pb.S3ApiConfiguration) (err error) {
+	buf := bytes.Buffer{}
+	if err := filer.ProtoToText(&buf, s3cfg); err != nil {
+		return fmt.Errorf("ProtoToText: %s", err)
+	}
+	return pb.WithOneOfGrpcFilerClients(false, iama.option.Filers, iama.option.GrpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+		err = util.Retry("saveIamIdentity", func() error {
+			return filer.SaveInsideFiler(context.Background(), client, filer.IamConfigDirectory, filer.IamIdentityFile, buf.Bytes())
+		})
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// GetPolicies returns the merged view of managed, user-inline, and group-inline
+// policies from the configured credential store, plus a one-shot fallback read
+// of the legacy /etc/iam/policies.json bundle. Routing reads through the
+// credential manager keeps the IAM API in sync with the Admin UI; the legacy
+// file fallback lets deployments that wrote policies before this change still
+// see them until the next PutPolicies migrates them into the store.
+func (iama *IamS3ApiConfigure) GetPolicies(policies *Policies) (err error) {
+	ctx := context.Background()
+
+	if policies.Policies == nil {
+		policies.Policies = make(map[string]policy_engine.PolicyDocument)
+	}
+
+	if iama.credentialManager != nil {
+		managed, mErr := iama.credentialManager.GetPolicies(ctx)
+		if mErr != nil {
+			return fmt.Errorf("load managed policies from credential store: %w", mErr)
+		}
+		for name, doc := range managed {
+			policies.Policies[name] = doc
+		}
+
+		inline, iErr := iama.credentialManager.LoadAllInlinePolicies(ctx)
+		if iErr != nil {
+			return fmt.Errorf("load user inline policies from credential store: %w", iErr)
+		}
+		mergeInline(&policies.InlinePolicies, inline)
+
+		groupInline, gErr := iama.credentialManager.LoadAllGroupInlinePolicies(ctx)
+		if gErr != nil {
+			return fmt.Errorf("load group inline policies from credential store: %w", gErr)
+		}
+		mergeInline(&policies.GroupInlinePolicies, groupInline)
+	}
+
+	// Legacy /etc/iam/policies.json fallback. Credential store wins on
+	// conflict (per name / per (user, name) / per (group, name)) so we never
+	// produce duplicates.
+	var buf bytes.Buffer
+	rErr := pb.WithOneOfGrpcFilerClients(false, iama.option.Filers, iama.option.GrpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+		return filer.ReadEntry(iama.masterClient, client, filer.IamConfigDirectory, filer.IamPoliciesFile, &buf)
+	})
+	if rErr != nil && rErr != filer_pb.ErrNotFound {
+		return fmt.Errorf("read legacy policies from filer: %w", rErr)
+	}
+	if rErr == filer_pb.ErrNotFound || buf.Len() == 0 {
+		return nil
+	}
+	var legacy Policies
+	if err := json.Unmarshal(buf.Bytes(), &legacy); err != nil {
+		return fmt.Errorf("unmarshal legacy policies: %w", err)
+	}
+	for name, doc := range legacy.Policies {
+		if _, exists := policies.Policies[name]; !exists {
+			policies.Policies[name] = doc
+		}
+	}
+	mergeInlineFallback(&policies.InlinePolicies, legacy.InlinePolicies)
+	mergeInlineFallback(&policies.GroupInlinePolicies, legacy.GroupInlinePolicies)
+	return nil
+}
+
+// PutPolicies persists managed, user-inline, and group-inline policies through
+// the credential store as deltas relative to its current contents. When the
+// credential store is something other than filer_etc (postgres, grpc, memory),
+// the legacy /etc/iam/policies.json bundle is cleared after a successful write
+// so that data merged in by the GetPolicies fallback during migration cannot
+// resurface — otherwise a later DeletePolicy would be undone by the next read.
+// For filer_etc the bundle is left alone because filer_etc owns it as its own
+// inline-policy backing store (see filer_etc.saveLegacyPoliciesCollection).
+// With no credential manager available (a test path), everything is written
+// back to the bundle, preserving the pre-refactor behavior.
+func (iama *IamS3ApiConfigure) PutPolicies(policies *Policies) (err error) {
+	ctx := context.Background()
+
+	if iama.credentialManager == nil {
+		legacy := Policies{
+			Policies:            policies.Policies,
+			InlinePolicies:      policies.InlinePolicies,
+			GroupInlinePolicies: policies.GroupInlinePolicies,
+		}
+		return iama.writeLegacyPolicies(ctx, &legacy)
+	}
+
+	// Managed delta.
+	currentManaged, gErr := iama.credentialManager.GetPolicies(ctx)
+	if gErr != nil {
+		return fmt.Errorf("read managed policies from credential store: %w", gErr)
+	}
+	for name, doc := range policies.Policies {
+		existing, found := currentManaged[name]
+		if !found {
+			if cErr := iama.credentialManager.CreatePolicy(ctx, name, doc); cErr != nil {
+				return fmt.Errorf("create policy %s in credential store: %w", name, cErr)
+			}
+			continue
+		}
+		if !reflect.DeepEqual(existing, doc) {
+			if uErr := iama.credentialManager.UpdatePolicy(ctx, name, doc); uErr != nil {
+				return fmt.Errorf("update policy %s in credential store: %w", name, uErr)
+			}
+		}
+	}
+	for name := range currentManaged {
+		if _, keep := policies.Policies[name]; !keep {
+			if dErr := iama.credentialManager.DeletePolicy(ctx, name); dErr != nil {
+				return fmt.Errorf("delete policy %s from credential store: %w", name, dErr)
+			}
+		}
+	}
+
+	// User-inline delta.
+	currentInline, iErr := iama.credentialManager.LoadAllInlinePolicies(ctx)
+	if iErr != nil {
+		return fmt.Errorf("read user inline policies from credential store: %w", iErr)
+	}
+	for user, desired := range policies.InlinePolicies {
+		existing := currentInline[user]
+		for name, doc := range desired {
+			if prior, found := existing[name]; found && reflect.DeepEqual(prior, doc) {
+				continue
+			}
+			if pErr := iama.credentialManager.PutUserInlinePolicy(ctx, user, name, doc); pErr != nil {
+				return fmt.Errorf("put inline policy %s/%s in credential store: %w", user, name, pErr)
+			}
+		}
+	}
+	for user, existing := range currentInline {
+		desired := policies.InlinePolicies[user]
+		for name := range existing {
+			if _, keep := desired[name]; keep {
+				continue
+			}
+			if dErr := iama.credentialManager.DeleteUserInlinePolicy(ctx, user, name); dErr != nil {
+				return fmt.Errorf("delete inline policy %s/%s from credential store: %w", user, name, dErr)
+			}
+		}
+	}
+
+	// Group-inline delta.
+	currentGroupInline, ggErr := iama.credentialManager.LoadAllGroupInlinePolicies(ctx)
+	if ggErr != nil {
+		return fmt.Errorf("read group inline policies from credential store: %w", ggErr)
+	}
+	for group, desired := range policies.GroupInlinePolicies {
+		existing := currentGroupInline[group]
+		for name, doc := range desired {
+			if prior, found := existing[name]; found && reflect.DeepEqual(prior, doc) {
+				continue
+			}
+			if pErr := iama.credentialManager.PutGroupInlinePolicy(ctx, group, name, doc); pErr != nil {
+				return fmt.Errorf("put group inline policy %s/%s in credential store: %w", group, name, pErr)
+			}
+		}
+	}
+	for group, existing := range currentGroupInline {
+		desired := policies.GroupInlinePolicies[group]
+		for name := range existing {
+			if _, keep := desired[name]; keep {
+				continue
+			}
+			if dErr := iama.credentialManager.DeleteGroupInlinePolicy(ctx, group, name); dErr != nil {
+				return fmt.Errorf("delete group inline policy %s/%s from credential store: %w", group, name, dErr)
+			}
+		}
+	}
+
+	// filer_etc owns the legacy bundle itself (it's how filer_etc persists
+	// inline policies). For every other store the bundle is at most a one-
+	// shot migration source — empty it so deleted legacy-only entries don't
+	// reappear via the GetPolicies fallback on the next read.
+	if iama.credentialManager.GetStoreName() == string(credential.StoreTypeFilerEtc) {
+		return nil
+	}
+	return iama.writeLegacyPolicies(ctx, &Policies{})
+}
+
+// writeLegacyPolicies serializes the given Policies struct to the legacy
+// /etc/iam/policies.json bundle. Called both for the no-credential-manager
+// fallback (full bundle) and for the credential-manager path (empty bundle,
+// to drain legacy data after migration).
+func (iama *IamS3ApiConfigure) writeLegacyPolicies(ctx context.Context, p *Policies) error {
+	b, err := json.Marshal(p)
+	if err != nil {
+		return fmt.Errorf("marshal legacy policies: %w", err)
+	}
+	return pb.WithOneOfGrpcFilerClients(false, iama.option.Filers, iama.option.GrpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+		return filer.SaveInsideFiler(ctx, client, filer.IamConfigDirectory, filer.IamPoliciesFile, b)
+	})
+}
+
+// mergeInline overwrites entries in dst with src (credential-store data taking
+// precedence over anything already in dst).
+func mergeInline(dst *map[string]map[string]policy_engine.PolicyDocument, src map[string]map[string]policy_engine.PolicyDocument) {
+	if len(src) == 0 {
+		return
+	}
+	if *dst == nil {
+		*dst = make(map[string]map[string]policy_engine.PolicyDocument, len(src))
+	}
+	for outer, byName := range src {
+		bucket := (*dst)[outer]
+		if bucket == nil {
+			bucket = make(map[string]policy_engine.PolicyDocument, len(byName))
+			(*dst)[outer] = bucket
+		}
+		for name, doc := range byName {
+			bucket[name] = doc
+		}
+	}
+}
+
+// mergeInlineFallback fills only entries that are missing in dst — the legacy
+// file never overrides whatever the credential store returned.
+func mergeInlineFallback(dst *map[string]map[string]policy_engine.PolicyDocument, src map[string]map[string]policy_engine.PolicyDocument) {
+	if len(src) == 0 {
+		return
+	}
+	if *dst == nil {
+		*dst = make(map[string]map[string]policy_engine.PolicyDocument, len(src))
+	}
+	for outer, byName := range src {
+		bucket := (*dst)[outer]
+		if bucket == nil {
+			bucket = make(map[string]policy_engine.PolicyDocument, len(byName))
+			(*dst)[outer] = bucket
+		}
+		for name, doc := range byName {
+			if _, exists := bucket[name]; !exists {
+				bucket[name] = doc
+			}
+		}
+	}
+}

weed/iamapi/iamapi_server_test.go

@@ -0,0 +1,253 @@
+package iamapi
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newIamS3ApiConfigureForTest builds an IamS3ApiConfigure backed by a memory
+// credential store and no filer. The filer-less option is fine because the
+// new code only touches the filer for inline/group policies, which these
+// tests don't exercise.
+func newIamS3ApiConfigureForTest(t *testing.T) (*IamS3ApiConfigure, *credential.CredentialManager) {
+	t.Helper()
+	store := &memory.MemoryStore{}
+	require.NoError(t, store.Initialize(nil, ""))
+	cm := &credential.CredentialManager{Store: store}
+	cfg := &IamS3ApiConfigure{
+		option:            &IamServerOption{},
+		credentialManager: cm,
+	}
+	return cfg, cm
+}
+
+func samplePolicyDocument(resource string) policy_engine.PolicyDocument {
+	return policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:Get*"),
+				Resource: policy_engine.NewStringOrStringSlicePtr(resource),
+			},
+		},
+	}
+}
+
+// TestPutPoliciesCreatesInCredentialStore is the regression test for
+// https://github.com/seaweedfs/seaweedfs/issues/9518: the IAM API used to
+// write managed policies straight to the filer, bypassing any non-filer
+// credential store (e.g. postgres). After the fix, a new policy passed to
+// PutPolicies must show up in the credential store.
+func TestPutPoliciesCreatesInCredentialStore(t *testing.T) {
+	cfg, cm := newIamS3ApiConfigureForTest(t)
+	ctx := context.Background()
+
+	doc := samplePolicyDocument("arn:aws:s3:::bucket-a")
+	require.NoError(t, cfg.PutPolicies(&Policies{
+		Policies: map[string]policy_engine.PolicyDocument{"policy-a": doc},
+	}))
+
+	stored, err := cm.GetPolicies(ctx)
+	require.NoError(t, err)
+	require.Contains(t, stored, "policy-a")
+	assert.Equal(t, doc, stored["policy-a"])
+}
+
+// TestGetPoliciesReadsFromCredentialStore mirrors the read side of the bug:
+// ListPolicies / GetPolicy via the IAM API used to read only the filer file
+// and therefore missed policies that the Admin UI had written to the store.
+func TestGetPoliciesReadsFromCredentialStore(t *testing.T) {
+	cfg, cm := newIamS3ApiConfigureForTest(t)
+	ctx := context.Background()
+
+	doc := samplePolicyDocument("arn:aws:s3:::bucket-b")
+	require.NoError(t, cm.CreatePolicy(ctx, "policy-b", doc))
+
+	loaded := Policies{}
+	require.NoError(t, cfg.GetPolicies(&loaded))
+	require.Contains(t, loaded.Policies, "policy-b")
+	assert.Equal(t, doc, loaded.Policies["policy-b"])
+}
+
+// TestPutPoliciesDeletesRemovedFromCredentialStore makes sure the delta path
+// translates an in-memory deletion (the pattern the DeletePolicy handler
+// uses) into a credential-store DeletePolicy call.
+func TestPutPoliciesDeletesRemovedFromCredentialStore(t *testing.T) {
+	cfg, cm := newIamS3ApiConfigureForTest(t)
+	ctx := context.Background()
+
+	keep := samplePolicyDocument("arn:aws:s3:::keep")
+	drop := samplePolicyDocument("arn:aws:s3:::drop")
+	require.NoError(t, cm.CreatePolicy(ctx, "keep", keep))
+	require.NoError(t, cm.CreatePolicy(ctx, "drop", drop))
+
+	// Caller fetched policies, removed "drop", and asked us to persist.
+	require.NoError(t, cfg.PutPolicies(&Policies{
+		Policies: map[string]policy_engine.PolicyDocument{"keep": keep},
+	}))
+
+	remaining, err := cm.GetPolicies(ctx)
+	require.NoError(t, err)
+	assert.Contains(t, remaining, "keep")
+	assert.NotContains(t, remaining, "drop")
+}
+
+// TestPutPoliciesUpdatesChangedInCredentialStore confirms the delta also
+// detects document changes for the same policy name.
+func TestPutPoliciesUpdatesChangedInCredentialStore(t *testing.T) {
+	cfg, cm := newIamS3ApiConfigureForTest(t)
+	ctx := context.Background()
+
+	original := samplePolicyDocument("arn:aws:s3:::v1")
+	require.NoError(t, cm.CreatePolicy(ctx, "p", original))
+
+	updated := samplePolicyDocument("arn:aws:s3:::v2")
+	require.NoError(t, cfg.PutPolicies(&Policies{
+		Policies: map[string]policy_engine.PolicyDocument{"p": updated},
+	}))
+
+	stored, err := cm.GetPolicy(ctx, "p")
+	require.NoError(t, err)
+	require.NotNil(t, stored)
+	assert.Equal(t, updated, *stored)
+}
+
+// TestPutPoliciesRoutesUserInlineThroughCredentialStore is the second half of
+// the #9518 fix: per-user inline policies created via the IAM API must land
+// in the credential store (so postgres users have a single source of truth)
+// rather than in the filer bundle.
+func TestPutPoliciesRoutesUserInlineThroughCredentialStore(t *testing.T) {
+	cfg, cm := newIamS3ApiConfigureForTest(t)
+	ctx := context.Background()
+
+	doc := samplePolicyDocument("arn:aws:s3:::user-bucket")
+	require.NoError(t, cfg.PutPolicies(&Policies{
+		InlinePolicies: map[string]map[string]policy_engine.PolicyDocument{
+			"alice": {"inline-1": doc},
+		},
+	}))
+
+	stored, err := cm.GetUserInlinePolicy(ctx, "alice", "inline-1")
+	require.NoError(t, err)
+	require.NotNil(t, stored)
+	assert.Equal(t, doc, *stored)
+}
+
+// TestPutPoliciesDeletesRemovedUserInline mirrors the deletion side. The
+// DeleteUserPolicy handler removes the entry from the in-memory map and calls
+// PutPolicies; the delta must call DeleteUserInlinePolicy.
+func TestPutPoliciesDeletesRemovedUserInline(t *testing.T) {
+	cfg, cm := newIamS3ApiConfigureForTest(t)
+	ctx := context.Background()
+
+	keep := samplePolicyDocument("arn:aws:s3:::keep")
+	drop := samplePolicyDocument("arn:aws:s3:::drop")
+	require.NoError(t, cm.PutUserInlinePolicy(ctx, "bob", "keep", keep))
+	require.NoError(t, cm.PutUserInlinePolicy(ctx, "bob", "drop", drop))
+
+	require.NoError(t, cfg.PutPolicies(&Policies{
+		InlinePolicies: map[string]map[string]policy_engine.PolicyDocument{
+			"bob": {"keep": keep},
+		},
+	}))
+
+	remaining, err := cm.ListUserInlinePolicies(ctx, "bob")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"keep"}, remaining)
+}
+
+// TestPutPoliciesRoutesGroupInlineThroughCredentialStore confirms group-attached
+// inline policies also persist via the credential manager rather than the
+// shared filer bundle.
+func TestPutPoliciesRoutesGroupInlineThroughCredentialStore(t *testing.T) {
+	cfg, cm := newIamS3ApiConfigureForTest(t)
+	ctx := context.Background()
+
+	doc := samplePolicyDocument("arn:aws:s3:::group-bucket")
+	require.NoError(t, cfg.PutPolicies(&Policies{
+		GroupInlinePolicies: map[string]map[string]policy_engine.PolicyDocument{
+			"devs": {"inline-g": doc},
+		},
+	}))
+
+	stored, err := cm.GetGroupInlinePolicy(ctx, "devs", "inline-g")
+	require.NoError(t, err)
+	require.NotNil(t, stored)
+	assert.Equal(t, doc, *stored)
+}
+
+// TestPutPoliciesDeletesRemovedGroupInline covers the deletion delta for
+// group-attached inline policies.
+func TestPutPoliciesDeletesRemovedGroupInline(t *testing.T) {
+	cfg, cm := newIamS3ApiConfigureForTest(t)
+	ctx := context.Background()
+
+	keep := samplePolicyDocument("arn:aws:s3:::keep")
+	drop := samplePolicyDocument("arn:aws:s3:::drop")
+	require.NoError(t, cm.PutGroupInlinePolicy(ctx, "devs", "keep", keep))
+	require.NoError(t, cm.PutGroupInlinePolicy(ctx, "devs", "drop", drop))
+
+	require.NoError(t, cfg.PutPolicies(&Policies{
+		GroupInlinePolicies: map[string]map[string]policy_engine.PolicyDocument{
+			"devs": {"keep": keep},
+		},
+	}))
+
+	remaining, err := cm.ListGroupInlinePolicies(ctx, "devs")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"keep"}, remaining)
+}
+
+// TestPutPoliciesIsAuthoritativeWhenStoreIsNotFilerEtc is the regression test
+// for the legacy-file resurrection bug: once the credential store is
+// authoritative, a delete must stick across the GetPolicies fallback. We
+// can't verify the legacy-file rewrite directly without a fake filer in
+// the test harness, but we can verify the cm-side delta behavior: a policy
+// that was deleted does not come back via cm on a subsequent fetch.
+func TestPutPoliciesIsAuthoritativeWhenStoreIsNotFilerEtc(t *testing.T) {
+	cfg, cm := newIamS3ApiConfigureForTest(t)
+	ctx := context.Background()
+
+	require.Equal(t, "memory", cm.GetStoreName(), "test depends on memory store name carveout")
+
+	doc := samplePolicyDocument("arn:aws:s3:::vanishing")
+	require.NoError(t, cfg.PutPolicies(&Policies{
+		Policies: map[string]policy_engine.PolicyDocument{"will-vanish": doc},
+	}))
+
+	require.NoError(t, cfg.PutPolicies(&Policies{
+		Policies: map[string]policy_engine.PolicyDocument{},
+	}))
+
+	remaining, err := cm.GetPolicies(ctx)
+	require.NoError(t, err)
+	assert.NotContains(t, remaining, "will-vanish")
+}
+
+// TestGetPoliciesReadsInlineAndGroupInlineFromCredentialStore confirms reads
+// pull user-inline and group-inline policies from the store too, so handlers
+// like ListUserPolicies / GetUserPolicy see Admin-UI writes.
+func TestGetPoliciesReadsInlineAndGroupInlineFromCredentialStore(t *testing.T) {
+	cfg, cm := newIamS3ApiConfigureForTest(t)
+	ctx := context.Background()
+
+	userDoc := samplePolicyDocument("arn:aws:s3:::user-data")
+	groupDoc := samplePolicyDocument("arn:aws:s3:::group-data")
+	require.NoError(t, cm.PutUserInlinePolicy(ctx, "carol", "u-policy", userDoc))
+	require.NoError(t, cm.PutGroupInlinePolicy(ctx, "admins", "g-policy", groupDoc))
+
+	loaded := Policies{}
+	require.NoError(t, cfg.GetPolicies(&loaded))
+
+	require.Contains(t, loaded.InlinePolicies, "carol")
+	assert.Equal(t, userDoc, loaded.InlinePolicies["carol"]["u-policy"])
+	require.Contains(t, loaded.GroupInlinePolicies, "admins")
+	assert.Equal(t, groupDoc, loaded.GroupInlinePolicies["admins"]["g-policy"])
+}

weed/iamapi/iamapi_test.go

@@ -0,0 +1,659 @@
+package iamapi
+
+import (
+	"context"
+	"encoding/json"
+	"encoding/xml"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"regexp"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/gorilla/mux"
+	"github.com/jinzhu/copier"
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/seaweedfs/seaweedfs/weed/util/request_id"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var GetS3ApiConfiguration func(s3cfg *iam_pb.S3ApiConfiguration) (err error)
+var PutS3ApiConfiguration func(s3cfg *iam_pb.S3ApiConfiguration) (err error)
+var GetPolicies func(policies *Policies) (err error)
+var PutPolicies func(policies *Policies) (err error)
+
+var s3config = iam_pb.S3ApiConfiguration{}
+var policiesFile = Policies{Policies: make(map[string]policy_engine.PolicyDocument)}
+var ias = IamApiServer{s3ApiConfig: iamS3ApiConfigureMock{}}
+
+type iamS3ApiConfigureMock struct{}
+
+func (iam iamS3ApiConfigureMock) GetS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) (err error) {
+	_ = copier.Copy(&s3cfg.Identities, &s3config.Identities)
+	return nil
+}
+
+func (iam iamS3ApiConfigureMock) PutS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) (err error) {
+	_ = copier.Copy(&s3config.Identities, &s3cfg.Identities)
+	return nil
+}
+
+func (iam iamS3ApiConfigureMock) GetPolicies(policies *Policies) (err error) {
+	_ = copier.Copy(&policies, &policiesFile)
+	return nil
+}
+
+func (iam iamS3ApiConfigureMock) PutPolicies(policies *Policies) (err error) {
+	_ = copier.Copy(&policiesFile, &policies)
+	return nil
+}
+
+func TestCreateUser(t *testing.T) {
+	userName := aws.String("Test")
+	params := &iam.CreateUserInput{UserName: userName}
+	req, _ := iam.New(session.New()).CreateUserRequest(params)
+	_ = req.Build()
+	out := CreateUserResponse{}
+	response, err := executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+	//assert.Equal(t, out.XMLName, "lol")
+}
+
+func TestListUsers(t *testing.T) {
+	params := &iam.ListUsersInput{}
+	req, _ := iam.New(session.New()).ListUsersRequest(params)
+	_ = req.Build()
+	out := ListUsersResponse{}
+	response, err := executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+}
+
+func TestListUsersRequestIdMatchesResponseHeader(t *testing.T) {
+	params := &iam.ListUsersInput{}
+	req, _ := iam.New(session.New()).ListUsersRequest(params)
+	_ = req.Build()
+
+	out := ListUsersResponse{}
+	response, err := executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+
+	headerRequestID := response.Header().Get(request_id.AmzRequestIDHeader)
+	assert.NotEmpty(t, headerRequestID)
+	assert.Equal(t, headerRequestID, extractRequestID(response))
+}
+
+func TestListAccessKeys(t *testing.T) {
+	svc := iam.New(session.New())
+	params := &iam.ListAccessKeysInput{}
+	req, _ := svc.ListAccessKeysRequest(params)
+	_ = req.Build()
+	out := ListAccessKeysResponse{}
+	response, err := executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+}
+
+func TestUpdateAccessKey(t *testing.T) {
+	svc := iam.New(session.New())
+
+	createReq, _ := svc.CreateAccessKeyRequest(&iam.CreateAccessKeyInput{UserName: aws.String("Test")})
+	_ = createReq.Build()
+	createOut := CreateAccessKeyResponse{}
+	response, err := executeRequest(createReq.HTTPRequest, createOut)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+
+	var createResp CreateAccessKeyResponse
+	err = xml.Unmarshal(response.Body.Bytes(), &createResp)
+	assert.Equal(t, nil, err)
+	accessKeyId := createResp.CreateAccessKeyResult.AccessKey.AccessKeyId
+	if accessKeyId == nil {
+		t.Fatalf("expected access key id to be set")
+	}
+
+	updateReq, _ := svc.UpdateAccessKeyRequest(&iam.UpdateAccessKeyInput{
+		UserName:    aws.String("Test"),
+		AccessKeyId: accessKeyId,
+		Status:      aws.String("Inactive"),
+	})
+	_ = updateReq.Build()
+	updateOut := UpdateAccessKeyResponse{}
+	response, err = executeRequest(updateReq.HTTPRequest, updateOut)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+
+	listReq, _ := svc.ListAccessKeysRequest(&iam.ListAccessKeysInput{UserName: aws.String("Test")})
+	_ = listReq.Build()
+	listOut := ListAccessKeysResponse{}
+	response, err = executeRequest(listReq.HTTPRequest, listOut)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+
+	var listResp ListAccessKeysResponse
+	err = xml.Unmarshal(response.Body.Bytes(), &listResp)
+	assert.Equal(t, nil, err)
+	found := false
+	for _, key := range listResp.ListAccessKeysResult.AccessKeyMetadata {
+		if key.AccessKeyId != nil && *key.AccessKeyId == *accessKeyId {
+			found = true
+			if assert.NotNil(t, key.Status) {
+				assert.Equal(t, "Inactive", *key.Status)
+			}
+			break
+		}
+	}
+	assert.True(t, found)
+}
+
+func TestGetUser(t *testing.T) {
+	userName := aws.String("Test")
+	params := &iam.GetUserInput{UserName: userName}
+	req, _ := iam.New(session.New()).GetUserRequest(params)
+	_ = req.Build()
+	out := GetUserResponse{}
+	response, err := executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+}
+
+// Todo flat statement
+func TestCreatePolicy(t *testing.T) {
+	params := &iam.CreatePolicyInput{
+		PolicyName: aws.String("S3-read-only-example-bucket"),
+		PolicyDocument: aws.String(`
+			{
+			  "Version": "2012-10-17",
+			  "Statement": [
+				{
+				  "Effect": "Allow",
+				  "Action": [
+					"s3:Get*",
+					"s3:List*"
+				  ],
+				  "Resource": [
+					"arn:aws:s3:::EXAMPLE-BUCKET",
+					"arn:aws:s3:::EXAMPLE-BUCKET/*"
+				  ]
+				}
+			  ]
+			}`),
+	}
+	req, _ := iam.New(session.New()).CreatePolicyRequest(params)
+	_ = req.Build()
+	out := CreatePolicyResponse{}
+	response, err := executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+}
+
+// isolatedIamConfig is a self-contained IamS3ApiConfig backing whose state lives
+// on the instance (not the package globals that executeRequest shares), so
+// policy-version tests stay order-independent under -shuffle.
+type isolatedIamConfig struct {
+	identities []*iam_pb.Identity
+	groups     []*iam_pb.Group
+	policies   Policies
+}
+
+func newIsolatedIamServer() *IamApiServer {
+	return &IamApiServer{s3ApiConfig: &isolatedIamConfig{
+		policies: Policies{Policies: make(map[string]policy_engine.PolicyDocument)},
+	}}
+}
+
+func (m *isolatedIamConfig) GetS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) error {
+	_ = copier.Copy(&s3cfg.Identities, &m.identities)
+	_ = copier.Copy(&s3cfg.Groups, &m.groups)
+	return nil
+}
+
+func (m *isolatedIamConfig) PutS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) error {
+	_ = copier.Copy(&m.identities, &s3cfg.Identities)
+	_ = copier.Copy(&m.groups, &s3cfg.Groups)
+	return nil
+}
+
+func (m *isolatedIamConfig) GetPolicies(policies *Policies) error {
+	_ = copier.Copy(&policies, &m.policies)
+	return nil
+}
+
+func (m *isolatedIamConfig) PutPolicies(policies *Policies) error {
+	_ = copier.Copy(&m.policies, &policies)
+	return nil
+}
+
+// TestCreatePolicyVersion reproduces issue #9785: the AWS Terraform provider
+// updates a managed policy in place via CreatePolicyVersion, which previously
+// returned 501 NotImplemented. The whole read/update surface Terraform relies on
+// is exercised here: GetPolicy (DefaultVersionId), CreatePolicyVersion,
+// GetPolicyVersion and ListPolicyVersions.
+func TestCreatePolicyVersion(t *testing.T) {
+	srv := newIsolatedIamServer()
+	svc := iam.New(session.New())
+	policyName := "tf-managed-policy"
+	policyArn := aws.String("arn:aws:iam:::policy/" + policyName)
+
+	// Create the managed policy.
+	createReq, _ := svc.CreatePolicyRequest(&iam.CreatePolicyInput{
+		PolicyName:     aws.String(policyName),
+		PolicyDocument: aws.String(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:Get*","s3:List*"],"Resource":["arn:aws:s3:::EXAMPLE-BUCKET"]}]}`),
+	})
+	_ = createReq.Build()
+	resp, err := executeRequestWith(srv, createReq.HTTPRequest, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	// Update it in place (what Terraform does). This used to return 501.
+	cpvReq, _ := svc.CreatePolicyVersionRequest(&iam.CreatePolicyVersionInput{
+		PolicyArn:      policyArn,
+		PolicyDocument: aws.String(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:Get*"],"Resource":["arn:aws:s3:::EXAMPLE-BUCKET"]}]}`),
+		SetAsDefault:   aws.Bool(true),
+	})
+	_ = cpvReq.Build()
+	resp, err = executeRequestWith(srv, cpvReq.HTTPRequest, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+	var cpvResp CreatePolicyVersionResponse
+	require.NoError(t, xml.Unmarshal(resp.Body.Bytes(), &cpvResp))
+	require.NotNil(t, cpvResp.CreatePolicyVersionResult.PolicyVersion.VersionId)
+	assert.Equal(t, "v1", *cpvResp.CreatePolicyVersionResult.PolicyVersion.VersionId)
+	require.NotNil(t, cpvResp.CreatePolicyVersionResult.PolicyVersion.IsDefaultVersion)
+	assert.True(t, *cpvResp.CreatePolicyVersionResult.PolicyVersion.IsDefaultVersion)
+
+	// GetPolicy must advertise a default version so Terraform's read can chain
+	// into GetPolicyVersion.
+	gpReq, _ := svc.GetPolicyRequest(&iam.GetPolicyInput{PolicyArn: policyArn})
+	_ = gpReq.Build()
+	resp, err = executeRequestWith(srv, gpReq.HTTPRequest, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+	var gpResp GetPolicyResponse
+	require.NoError(t, xml.Unmarshal(resp.Body.Bytes(), &gpResp))
+	require.NotNil(t, gpResp.GetPolicyResult.Policy.DefaultVersionId)
+	assert.Equal(t, "v1", *gpResp.GetPolicyResult.Policy.DefaultVersionId)
+
+	// GetPolicyVersion must return the updated document (Get* only, List* gone).
+	gpvReq, _ := svc.GetPolicyVersionRequest(&iam.GetPolicyVersionInput{PolicyArn: policyArn, VersionId: aws.String("v1")})
+	_ = gpvReq.Build()
+	resp, err = executeRequestWith(srv, gpvReq.HTTPRequest, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+	var gpvResp GetPolicyVersionResponse
+	require.NoError(t, xml.Unmarshal(resp.Body.Bytes(), &gpvResp))
+	require.NotNil(t, gpvResp.GetPolicyVersionResult.PolicyVersion.Document)
+	assert.Contains(t, *gpvResp.GetPolicyVersionResult.PolicyVersion.Document, "s3:Get*")
+	assert.NotContains(t, *gpvResp.GetPolicyVersionResult.PolicyVersion.Document, "s3:List*")
+
+	// ListPolicyVersions must report exactly the single default version.
+	lpvReq, _ := svc.ListPolicyVersionsRequest(&iam.ListPolicyVersionsInput{PolicyArn: policyArn})
+	_ = lpvReq.Build()
+	resp, err = executeRequestWith(srv, lpvReq.HTTPRequest, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+	var lpvResp ListPolicyVersionsResponse
+	require.NoError(t, xml.Unmarshal(resp.Body.Bytes(), &lpvResp))
+	require.Len(t, lpvResp.ListPolicyVersionsResult.Versions, 1)
+	assert.Equal(t, "v1", *lpvResp.ListPolicyVersionsResult.Versions[0].VersionId)
+}
+
+// TestCreatePolicyVersionMissingPolicy verifies a NoSuchEntity (404) when the
+// target policy does not exist, matching AWS.
+func TestCreatePolicyVersionMissingPolicy(t *testing.T) {
+	srv := newIsolatedIamServer()
+	req, _ := iam.New(session.New()).CreatePolicyVersionRequest(&iam.CreatePolicyVersionInput{
+		PolicyArn:      aws.String("arn:aws:iam:::policy/does-not-exist"),
+		PolicyDocument: aws.String(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:Get*"],"Resource":["arn:aws:s3:::EXAMPLE-BUCKET"]}]}`),
+		SetAsDefault:   aws.Bool(true),
+	})
+	_ = req.Build()
+	resp, err := executeRequestWith(srv, req.HTTPRequest, nil)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, resp.Code)
+	code, _ := extractErrorCodeAndMessage(resp)
+	assert.Equal(t, "NoSuchEntity", code)
+}
+
+// TestCreatePolicyVersionRequiresSetAsDefault verifies that, given the
+// single-version model, a request that does not set SetAsDefault=true is
+// rejected rather than silently overwriting the active document.
+func TestCreatePolicyVersionRequiresSetAsDefault(t *testing.T) {
+	srv := newIsolatedIamServer()
+	svc := iam.New(session.New())
+	policyArn := aws.String("arn:aws:iam:::policy/tf-managed-policy")
+
+	createReq, _ := svc.CreatePolicyRequest(&iam.CreatePolicyInput{
+		PolicyName:     aws.String("tf-managed-policy"),
+		PolicyDocument: aws.String(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:Get*"],"Resource":["arn:aws:s3:::EXAMPLE-BUCKET"]}]}`),
+	})
+	_ = createReq.Build()
+	resp, err := executeRequestWith(srv, createReq.HTTPRequest, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	// SetAsDefault omitted (defaults to false) must be rejected.
+	cpvReq, _ := svc.CreatePolicyVersionRequest(&iam.CreatePolicyVersionInput{
+		PolicyArn:      policyArn,
+		PolicyDocument: aws.String(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:Put*"],"Resource":["arn:aws:s3:::EXAMPLE-BUCKET"]}]}`),
+	})
+	_ = cpvReq.Build()
+	resp, err = executeRequestWith(srv, cpvReq.HTTPRequest, nil)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusBadRequest, resp.Code)
+	code, _ := extractErrorCodeAndMessage(resp)
+	assert.Equal(t, "InvalidInput", code)
+
+	// The live document must be untouched (still Get*, not Put*).
+	gpvReq, _ := svc.GetPolicyVersionRequest(&iam.GetPolicyVersionInput{PolicyArn: policyArn, VersionId: aws.String("v1")})
+	_ = gpvReq.Build()
+	resp, err = executeRequestWith(srv, gpvReq.HTTPRequest, nil)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+	var gpvResp GetPolicyVersionResponse
+	require.NoError(t, xml.Unmarshal(resp.Body.Bytes(), &gpvResp))
+	require.NotNil(t, gpvResp.GetPolicyVersionResult.PolicyVersion.Document)
+	assert.Contains(t, *gpvResp.GetPolicyVersionResult.PolicyVersion.Document, "s3:Get*")
+	assert.NotContains(t, *gpvResp.GetPolicyVersionResult.PolicyVersion.Document, "s3:Put*")
+}
+
+func TestPutUserPolicy(t *testing.T) {
+	userName := aws.String("Test")
+	params := &iam.PutUserPolicyInput{
+		UserName:   userName,
+		PolicyName: aws.String("S3-read-only-example-bucket"),
+		PolicyDocument: aws.String(
+			`{
+				  "Version": "2012-10-17",
+				  "Statement": [
+					{
+					  "Effect": "Allow",
+					  "Action": [
+						"s3:Get*",
+						"s3:List*"
+					  ],
+					  "Resource": [
+						"arn:aws:s3:::EXAMPLE-BUCKET",
+						"arn:aws:s3:::EXAMPLE-BUCKET/*"
+					  ]
+					}
+				  ]
+			}`),
+	}
+	req, _ := iam.New(session.New()).PutUserPolicyRequest(params)
+	_ = req.Build()
+	out := PutUserPolicyResponse{}
+	response, err := executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+}
+
+func TestPutUserPolicyError(t *testing.T) {
+	userName := aws.String("InvalidUser")
+	params := &iam.PutUserPolicyInput{
+		UserName:   userName,
+		PolicyName: aws.String("S3-read-only-example-bucket"),
+		PolicyDocument: aws.String(
+			`{
+				  "Version": "2012-10-17",
+				  "Statement": [
+					{
+					  "Effect": "Allow",
+					  "Action": [
+						"s3:Get*",
+						"s3:List*"
+					  ],
+					  "Resource": [
+						"arn:aws:s3:::EXAMPLE-BUCKET",
+						"arn:aws:s3:::EXAMPLE-BUCKET/*"
+					  ]
+					}
+				  ]
+			}`),
+	}
+	req, _ := iam.New(session.New()).PutUserPolicyRequest(params)
+	_ = req.Build()
+	response, err := executeRequest(req.HTTPRequest, nil)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusNotFound, response.Code)
+
+	expectedMessage := "the user with name InvalidUser cannot be found"
+	expectedCode := "NoSuchEntity"
+
+	code, message := extractErrorCodeAndMessage(response)
+
+	assert.Equal(t, expectedMessage, message)
+	assert.Equal(t, expectedCode, code)
+	assert.Contains(t, response.Body.String(), "<RequestId>")
+	assert.NotContains(t, response.Body.String(), "<ResponseMetadata>")
+	assert.Equal(t, response.Header().Get(request_id.AmzRequestIDHeader), extractRequestID(response))
+}
+
+func extractErrorCodeAndMessage(response *httptest.ResponseRecorder) (string, string) {
+	pattern := `<Error><Code>(.*)</Code><Message>(.*)</Message><Type>(.*)</Type></Error>`
+	re := regexp.MustCompile(pattern)
+
+	code := re.FindStringSubmatch(response.Body.String())[1]
+	message := re.FindStringSubmatch(response.Body.String())[2]
+	return code, message
+}
+
+func extractRequestID(response *httptest.ResponseRecorder) string {
+	re := regexp.MustCompile(`<RequestId>([^<]+)</RequestId>`)
+	matches := re.FindStringSubmatch(response.Body.String())
+	if len(matches) < 2 {
+		return ""
+	}
+	return matches[1]
+}
+
+func TestGetUserPolicy(t *testing.T) {
+	userName := aws.String("Test")
+	params := &iam.GetUserPolicyInput{UserName: userName, PolicyName: aws.String("S3-read-only-example-bucket")}
+	req, _ := iam.New(session.New()).GetUserPolicyRequest(params)
+	_ = req.Build()
+	out := GetUserPolicyResponse{}
+	response, err := executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+}
+
+func TestUpdateUser(t *testing.T) {
+	userName := aws.String("Test")
+	newUserName := aws.String("Test-New")
+	params := &iam.UpdateUserInput{NewUserName: newUserName, UserName: userName}
+	req, _ := iam.New(session.New()).UpdateUserRequest(params)
+	_ = req.Build()
+	out := UpdateUserResponse{}
+	response, err := executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+}
+
+func TestDeleteUser(t *testing.T) {
+	userName := aws.String("Test-New")
+	params := &iam.DeleteUserInput{UserName: userName}
+	req, _ := iam.New(session.New()).DeleteUserRequest(params)
+	_ = req.Build()
+	out := DeleteUserResponse{}
+	response, err := executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusOK, response.Code)
+}
+
+func executeRequest(req *http.Request, v interface{}) (*httptest.ResponseRecorder, error) {
+	rr := httptest.NewRecorder()
+	apiRouter := mux.NewRouter().SkipClean(true)
+	apiRouter.Path("/").Methods(http.MethodPost).HandlerFunc(ias.DoActions)
+	apiRouter.ServeHTTP(rr, req)
+	return rr, xml.Unmarshal(rr.Body.Bytes(), &v)
+}
+
+func TestHandleImplicitUsername(t *testing.T) {
+	// Create a mock IamApiServer with credential store
+	// The handleImplicitUsername function now looks up the username from the
+	// credential store based on AccessKeyId, not from the region field in the auth header.
+	// Note: Using obviously fake access keys to avoid CI secret scanner false positives
+
+	// Create IAM directly as struct literal (same pattern as other tests)
+	iam := &s3api.IdentityAccessManagement{}
+
+	// Load test credentials - map access key to identity name
+	testConfig := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{
+			{
+				Name: "testuser1",
+				Credentials: []*iam_pb.Credential{
+					{AccessKey: "AKIATESTFAKEKEY000001", SecretKey: "testsecretfake"},
+				},
+			},
+		},
+	}
+	err := iam.LoadS3ApiConfigurationFromBytes(mustMarshalJSON(t, testConfig))
+	if err != nil {
+		t.Fatalf("Failed to load test config: %v", err)
+	}
+
+	iama := &IamApiServer{
+		iam: iam,
+	}
+
+	var tests = []struct {
+		r        *http.Request
+		values   url.Values
+		userName string
+	}{
+		// No authorization header - should not set username
+		{&http.Request{}, url.Values{}, ""},
+		// Valid auth header with known access key - should look up and find "testuser1"
+		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIATESTFAKEKEY000001/20220420/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, "testuser1"},
+		// Malformed auth header (no Credential=) - should not set username
+		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 =AKIATESTFAKEKEY000001/20220420/test1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, ""},
+		// Unknown access key - should not set username
+		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIATESTUNKNOWN000000/20220420/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, ""},
+	}
+
+	for i, test := range tests {
+		iama.handleImplicitUsername(test.r, test.values)
+		if un := test.values.Get("UserName"); un != test.userName {
+			t.Errorf("No.%d: Got: %v, Expected: %v", i, un, test.userName)
+		}
+	}
+}
+
+func mustMarshalJSON(t *testing.T, v interface{}) []byte {
+	t.Helper()
+	data, err := json.Marshal(v)
+	if err != nil {
+		t.Fatalf("failed to marshal JSON: %v", err)
+	}
+	return data
+}
+
+// iamApiServerWithCredentialManager builds an IamApiServer backed by a real
+// in-memory credential store. Used for tests that exercise the targeted
+// credentialManager paths (e.g. CreateUser) instead of the legacy mock.
+func iamApiServerWithCredentialManager() (*IamApiServer, *credential.CredentialManager, *countingConfigSaver) {
+	store := &memory.MemoryStore{}
+	store.Initialize(nil, "")
+	cm := &credential.CredentialManager{Store: store}
+
+	counter := &countingConfigSaver{cm: cm}
+	iamInstance := &s3api.IdentityAccessManagement{}
+	// Wire up the credential manager so GetCredentialManager() returns it.
+	iamInstance.SetCredentialManagerForTest(cm)
+
+	srv := &IamApiServer{
+		s3ApiConfig: counter,
+		iam:         iamInstance,
+	}
+	return srv, cm, counter
+}
+
+// countingConfigSaver wraps the credential manager and counts full-config saves.
+type countingConfigSaver struct {
+	cm        *credential.CredentialManager
+	putCalled int
+}
+
+func (c *countingConfigSaver) GetS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) error {
+	config, err := c.cm.LoadConfiguration(context.Background())
+	if err != nil {
+		return err
+	}
+	s3cfg.Identities = config.Identities
+	s3cfg.Policies = config.Policies
+	return nil
+}
+
+func (c *countingConfigSaver) PutS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) error {
+	c.putCalled++
+	return c.cm.SaveConfiguration(context.Background(), s3cfg)
+}
+
+func (c *countingConfigSaver) GetPolicies(policies *Policies) error {
+	return nil
+}
+
+func (c *countingConfigSaver) PutPolicies(policies *Policies) error {
+	return nil
+}
+
+func executeRequestWith(srv *IamApiServer, req *http.Request, v interface{}) (*httptest.ResponseRecorder, error) {
+	rr := httptest.NewRecorder()
+	apiRouter := mux.NewRouter().SkipClean(true)
+	apiRouter.Path("/").Methods(http.MethodPost).HandlerFunc(srv.DoActions)
+	apiRouter.ServeHTTP(rr, req)
+	return rr, xml.Unmarshal(rr.Body.Bytes(), &v)
+}
+
+// TestCreateUserDoesNotSaveAllUsers is a regression test for the bug where
+// creating a new user triggered a full SaveConfiguration over all existing
+// identities (causing N file writes + reload cycles in the filer_etc store).
+// The fix uses credentialManager.CreateUser for a targeted single-file write.
+func TestCreateUserDoesNotSaveAllUsers(t *testing.T) {
+	srv, cm, counter := iamApiServerWithCredentialManager()
+	ctx := context.Background()
+
+	// Pre-populate three existing users.
+	for _, name := range []string{"existing-1", "existing-2", "existing-3"} {
+		require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: name}))
+	}
+
+	// Create a new user via the HTTP API.
+	params := &iam.CreateUserInput{UserName: aws.String("new-user")}
+	req, _ := iam.New(session.New()).CreateUserRequest(params)
+	_ = req.Build()
+	out := CreateUserResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	// The new user must appear in the store.
+	newUser, userErr := cm.GetUser(ctx, "new-user")
+	require.NoError(t, userErr)
+	require.Equal(t, "new-user", newUser.Name)
+
+	// Critical: full SaveConfiguration (PutS3ApiConfiguration) must NOT have
+	// been called. Before the fix it was called once per CreateUser, rewriting
+	// every existing user file and triggering a cascade of reload events.
+	assert.Equal(t, 0, counter.putCalled,
+		"CreateUser must not trigger a full PutS3ApiConfiguration over all users")
+
+	// All pre-existing users must still be intact.
+	for _, name := range []string{"existing-1", "existing-2", "existing-3"} {
+		u, err := cm.GetUser(ctx, name)
+		require.NoError(t, err, "pre-existing user %s should still exist", name)
+		assert.Equal(t, name, u.Name)
+	}
+}