fix(pools): keep rejected names out of a single-pool bulk delete

DeleteObjects checks every name with checkDelObjArgs, but a single pool
still sent all entries to the drives and cleared the error of an entry
that a drive reported as found. Local drives join the name to the bucket
directory, so a name with a ".." segment reached another bucket or the
meta bucket. An S3 DeleteObjects caller allowed to delete in one bucket
could remove a version elsewhere, including one under Object Lock
retention, and from a versioned bucket could write a delete marker on an
object of another bucket or on stored bucket metadata. The bulk lock was
taken on the normalized name as well, that is on the other object.

Entries that fail the check now keep their error, and the rest of the
request runs as a request of its own, before any lock or lookup. A
request whose names are all valid does not enter the new code. More than
one pool already skipped such entries.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: Feng Ruohang <rh@vonng.com>

CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## Unreleased
+
+- An edit of a service account or access key that names no policy keeps its
+  inline policy. `mcli admin user svcacct disable`, `enable` and `edit` without
+  `--policy`, the same `idp ldap accesskey` commands, and any other
+  `update-service-account` request without `newPolicy` removed the inline
+  policy at the site that took the request and, for an account of another user
+  than root, at its replication peers, and the account then had all its parent
+  is allowed. The inline policy is removed
+  only on request, by an empty policy document such as `{"Statement":[]}`
+  (`mcli admin user svcacct edit --policy`); a client that left the policy out
+  to remove it must send that document. A JSON `null` policy counts as none.
+  In the Console, clearing the policy editor of an access key no longer removes
+  the policy; enter `{}` to remove it. The fix does not bring back a policy
+  that was removed, and a site of a replicated deployment that does not run the
+  fix still removes the policy when such an edit reaches it, so sites can
+  differ. Upgrade every site, then review on each site the accounts that
+  `svcacct info` reports with `Policy: implied`, and set the policy again on
+  those that were meant to be restricted.
+
+- S3 `DeleteObjects` on a single pool stops at an entry whose name fails the
+  object name check: the entry returns `XMinioInvalidObjectName` and is not
+  locked or sent to a drive, as with a single-object DELETE and with more than
+  one pool. Until now such an entry still reached the drives of the node, where
+  a name with a `..` segment was joined to the request bucket. A caller allowed
+  to delete in one bucket could remove a version in another bucket, including
+  one under Object Lock retention, and from a versioned bucket could put a
+  delete marker on an object of another bucket or on stored system metadata
+  such as a bucket's configuration. The other entries of a request are deleted
+  as before.
+
 ## RELEASE.2026-11-09T00-00-00Z
 
 Package version: `20261109000000.0.0`. Publication status and artifacts are

cmd/admin-handlers-users.go

@@ -885,16 +885,16 @@ func (a adminAPIHandlers) UpdateServiceAccount(w http.ResponseWriter, r *http.Re
 		return
 	}
 
+	// A request without a policy, or with a JSON null for one, keeps the
+	// policy the account has. An empty policy document is passed on as
+	// such: it is the request to remove the embedded policy.
 	var sp *policy.Policy
-	if len(updateReq.NewPolicy) > 0 {
+	if len(updateReq.NewPolicy) > 0 && !bytes.Equal(updateReq.NewPolicy, []byte("null")) {
 		sp, err = policy.ParseConfigStrict(bytes.NewReader(updateReq.NewPolicy))
 		if err != nil {
 			writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
 			return
 		}
-		if sp.Version == "" && len(sp.Statements) == 0 {
-			sp = nil
-		}
 	}
 	opts := updateServiceAccountOpts{
 		secretKey:     updateReq.NewSecretKey,

cmd/bulk-delete-invalid-name_test.go

@@ -0,0 +1,156 @@
+// Copyright (c) 2026 PGSTY
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package cmd
+
+import (
+	"bytes"
+	"encoding/xml"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"testing"
+
+	"github.com/minio/minio/internal/auth"
+)
+
+// A bulk delete joins each name to the request bucket on the drives, so a name
+// with a ".." segment names a path in another bucket or in the meta bucket.
+// Such a name is the error of its own entry and reaches no drive, and the
+// other entries of the request are deleted as usual. This holds for the one
+// bulk lock of a single node, for a pool that locks per set, and for more than
+// one pool.
+func TestPoolsBulkDeleteInvalidNames(t *testing.T) {
+	for _, topology := range []struct {
+		name string
+		new  func(t *testing.T) (*erasureServerPools, string)
+	}{
+		{"single node", func(t *testing.T) (*erasureServerPools, string) { return bulkDeletePools(t, 1) }},
+		{"set locks", func(t *testing.T) (*erasureServerPools, string) { return ldPool(t, ldLocal) }},
+		{"two pools", func(t *testing.T) (*erasureServerPools, string) { return bulkDeletePools(t, 2) }},
+	} {
+		t.Run(topology.name, func(t *testing.T) {
+			z, bucket := topology.new(t)
+			ctx := t.Context()
+			other := "bulk-delete-other"
+			if err := z.MakeBucket(ctx, other, MakeBucketOptions{VersioningEnabled: true}); err != nil {
+				t.Fatal(err)
+			}
+			old := batchPutVersion(t, z, other, "kept", nil)
+			latest := batchPutVersion(t, z, other, "kept", nil)
+			batchPutVersion(t, z, other, "visible", nil)
+			metaKey := pathJoin(bucketMetaPrefix, other, bucketMetadataFile)
+			if !batchVersionExists(t, z, minioMetaBucket, metaKey, "") {
+				t.Fatal("the bucket metadata is not an object of the meta bucket")
+			}
+			for _, key := range []string{"own", "dir/"} {
+				if _, err := z.PutObject(ctx, bucket, key, mustGetPutObjReader(t, bytes.NewReader(nil), 0, "", ""), ObjectOptions{}); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			names := []ObjectToDelete{
+				{ObjectV: ObjectV{ObjectName: "../" + other + "/kept", VersionID: old.VersionID}}, // purge in another bucket
+				{ObjectV: ObjectV{ObjectName: "own"}},
+				{ObjectV: ObjectV{ObjectName: "a/../../" + other + "/visible"}},         // marker in another bucket
+				{ObjectV: ObjectV{ObjectName: "../" + minioMetaBucket + "/" + metaKey}}, // marker on bucket metadata
+				{ObjectV: ObjectV{ObjectName: "dir/"}},
+				{ObjectV: ObjectV{ObjectName: ""}},
+			}
+			invalid := map[int]bool{0: true, 2: true, 3: true, 5: true}
+			// Without a version ID these options ask for a delete marker, the
+			// one write a bulk delete makes.
+			deleted, errs := z.DeleteObjects(ctx, bucket, slices.Clone(names), ObjectOptions{Versioned: true})
+			for i, name := range names {
+				_, rejected := errs[i].(ObjectNameInvalid)
+				if rejected != invalid[i] || !invalid[i] && errs[i] != nil {
+					t.Errorf("%d %q: error = %v, rejected as invalid = %v, want %v", i, name.ObjectName, errs[i], rejected, invalid[i])
+				}
+				if deleted[i].ObjectName != name.ObjectName || deleted[i].found == invalid[i] {
+					t.Errorf("%d %q: result = %+v", i, name.ObjectName, deleted[i])
+				}
+			}
+
+			for _, version := range []string{old.VersionID, latest.VersionID} {
+				if !batchVersionExists(t, z, other, "kept", version) {
+					t.Errorf("version %q of the object in the other bucket was removed", version)
+				}
+			}
+			if !batchVersionExists(t, z, other, "visible", "") {
+				t.Error("the object of the other bucket is hidden by a marker")
+			}
+			if !batchVersionExists(t, z, minioMetaBucket, metaKey, "") {
+				t.Error("the metadata of the other bucket is hidden by a marker")
+			}
+			for _, key := range []string{"own", "dir/"} {
+				if batchVersionExists(t, z, bucket, key, "") {
+					t.Errorf("%q of the request bucket was not deleted", key)
+				}
+			}
+		})
+	}
+}
+
+// The names of an S3 DeleteObjects request come from its body, which the path
+// checks of the request URL do not see. A user allowed to delete in one bucket
+// reaches nothing outside it through such a name: a version under COMPLIANCE
+// retention in another bucket stays, and no delete marker lands on that object
+// or on the stored metadata of its bucket.
+func TestBulkDeleteObjectLockNameOutsideBucket(t *testing.T) {
+	defer DetectTestLeak(t)()
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{
+		t: t, endpoints: []string{"DeleteMultipleObjects"},
+		makeBucketOptions: MakeBucketOptions{VersioningEnabled: true},
+		objAPITest: func(obj ObjectLayer, instance, bucket string, router http.Handler, _ auth.Credentials, t *testing.T) {
+			ctx := t.Context()
+			user := newObjectAttributesAuthzUser(t, instance, bucket, `"s3:DeleteObject","s3:DeleteObjectVersion"`)
+			locked := getRandomBucketName()
+			if err := obj.MakeBucket(ctx, locked, MakeBucketOptions{VersioningEnabled: true, LockEnabled: true}); err != nil {
+				t.Fatal(err)
+			}
+			enableBucketObjectLock(t, locked)
+			worm := batchPutVersion(t, obj, locked, "secret", batchLockMeta("COMPLIANCE"))
+			batchPutVersion(t, obj, bucket, "own", nil)
+			metaKey := pathJoin(bucketMetaPrefix, locked, bucketMetadataFile)
+
+			outside := []ObjectToDelete{
+				{ObjectV: ObjectV{ObjectName: "../" + locked + "/secret", VersionID: worm.VersionID}},
+				{ObjectV: ObjectV{ObjectName: "../" + locked + "/secret"}},
+				{ObjectV: ObjectV{ObjectName: "../" + minioMetaBucket + "/" + metaKey}},
+			}
+			body := encodeResponse(DeleteObjectsRequest{Objects: append(slices.Clone(outside), ObjectToDelete{ObjectV: ObjectV{ObjectName: "own"}})})
+			req, err := newTestSignedRequestV4(http.MethodPost, getDeleteMultipleObjectsURL("", bucket), int64(len(body)), bytes.NewReader(body),
+				user.AccessKey, user.SecretKey, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rec := httptest.NewRecorder()
+			router.ServeHTTP(rec, req)
+			var resp DeleteObjectsResponse
+			if rec.Code != http.StatusOK || xml.Unmarshal(rec.Body.Bytes(), &resp) != nil {
+				t.Fatalf("%s: status %d: %s", instance, rec.Code, rec.Body.String())
+			}
+
+			if len(resp.DeletedObjects) != 1 || resp.DeletedObjects[0].ObjectName != "own" || len(resp.Errors) != len(outside) {
+				t.Errorf("%s: want the three names outside the bucket refused and \"own\" deleted: %s", instance, rec.Body.String())
+			}
+			for _, e := range resp.Errors {
+				if e.Code != errorCodes[ErrInvalidObjectName].Code {
+					t.Errorf("%s: %q: code %s, want %s", instance, e.Key, e.Code, errorCodes[ErrInvalidObjectName].Code)
+				}
+			}
+			if !batchVersionExists(t, obj, locked, "secret", worm.VersionID) {
+				t.Errorf("%s: the version under COMPLIANCE retention in the other bucket was removed", instance)
+			}
+			if !batchVersionExists(t, obj, locked, "secret", "") {
+				t.Errorf("%s: a delete marker hides the object of the other bucket", instance)
+			}
+			if !batchVersionExists(t, obj, minioMetaBucket, metaKey, "") {
+				t.Errorf("%s: a delete marker hides the stored metadata of the other bucket", instance)
+			}
+			if batchVersionExists(t, obj, bucket, "own", "") {
+				t.Errorf("%s: the object of the request bucket was not deleted", instance)
+			}
+		},
+	})
+}

cmd/erasure-server-pool.go

@@ -26,6 +26,7 @@ import (
 	"math/rand"
 	"net/http"
 	"path"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -1543,6 +1544,27 @@ func (z *erasureServerPools) DeleteObjects(ctx context.Context, bucket string, o
 		objSets.Add(objects[i].ObjectName)
 	}
 
+	// A name that fails the check keeps its error and goes no further. Joined
+	// to the bucket it can name a path in another bucket or in the meta
+	// bucket, so it is not locked, looked up or sent to a drive. The other
+	// names are deleted as a request of their own: everything below sees only
+	// names that passed.
+	if slices.ContainsFunc(derrs, func(err error) bool { return err != nil }) {
+		valid, at := make([]ObjectToDelete, 0, len(objects)), make([]int, 0, len(objects))
+		for i, obj := range objects {
+			if derrs[i] == nil {
+				valid, at = append(valid, obj), append(at, i)
+			}
+		}
+		if len(valid) > 0 {
+			deleted, errs := z.DeleteObjects(ctx, bucket, valid, opts)
+			for j, i := range at {
+				dobjects[i], derrs[i] = deleted[j], errs[j]
+			}
+		}
+		return dobjects, derrs
+	}
+
 	// A single pool locks each name in the set its writers lock it in, one
 	// set at a time. A single node keeps one lock table for all sets, so it
 	// keeps the one bulk lock below: its local lock takes the names one by

cmd/iam-store.go

@@ -2930,11 +2930,12 @@ func updatedServiceAccountCredentials(ctx context.Context, accessKey string, cr
 	// at this point.
 	m.Delete(sessionPolicyNameExtracted)
 
-	nosp := opts.sessionPolicy == nil || opts.sessionPolicy.Version == "" && len(opts.sessionPolicy.Statements) == 0
-
-	// sessionPolicy is nil and there is embedded policy attached we remove
-	// embedded policy at that point.
-	if _, ok := m.Lookup(policy.SessionPolicyName); ok && nosp {
+	// A nil sessionPolicy is an edit that does not concern the policy, and
+	// the embedded one stays. Only a policy that was given, and is empty,
+	// removes it: the account then has all its parent is allowed, which is
+	// usually more.
+	reset := opts.sessionPolicy != nil && opts.sessionPolicy.Version == "" && len(opts.sessionPolicy.Statements) == 0
+	if _, ok := m.Lookup(policy.SessionPolicyName); ok && reset {
 		m.Delete(policy.SessionPolicyName)
 		m.Set(iamPolicyClaimNameSA(), inheritedPolicyType)
 	}

cmd/iam-svcacct-policy-edit_test.go

@@ -0,0 +1,227 @@
+// Copyright (c) 2026 PGSTY
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+package cmd
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/minio/madmin-go/v3"
+	minio "github.com/minio/minio-go/v7"
+	"github.com/minio/minio/internal/auth"
+	"github.com/pgsty/silo-pkg/v3/policy"
+)
+
+// An edit of a service account that names no policy keeps the embedded
+// policy: the account must not come out of a status change, a key rotation
+// or a rename with all its parent is allowed. Only a policy that is given
+// and empty removes the embedded one.
+
+const svcAccEditPolicy = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject"],"Resource":["arn:aws:s3:::edit/*"]}]}`
+
+func TestIAMServiceAccountEditKeepsPolicy(t *testing.T) {
+	f := newGroupRefreshFixture(t)
+	want, err := policy.ParseConfig(strings.NewReader(svcAccEditPolicy))
+	mustIAM(t, err)
+
+	// restricted creates a service account with the embedded policy.
+	restricted := func(t *testing.T, key, status string) {
+		t.Helper()
+		_, _, err := f.sys.NewServiceAccount(f.ctx, f.parent.AccessKey, nil, newServiceAccountOpts{accessKey: key, secretKey: "edit-original-secret", status: status, sessionPolicy: want})
+		mustIAM(t, err)
+	}
+	// embedded reports whether this server and storage have the policy, and
+	// returns the stored credential.
+	embedded := func(t *testing.T, key string) (cached, stored bool, cr auth.Credentials) {
+		t.Helper()
+		_, got, err := f.sys.GetServiceAccount(f.ctx, key)
+		mustIAM(t, err)
+		if got != nil && !got.Equals(*want) {
+			t.Fatalf("the embedded policy changed: %+v", got)
+		}
+		u, ok := f.stored(t, key)
+		if !ok {
+			t.Fatal("service account missing in storage")
+		}
+		claims, err := getClaimsFromTokenWithSecret(u.Credentials.SessionToken, u.Credentials.SecretKey)
+		mustIAM(t, err)
+		_, hasPolicy := claims.Lookup(policy.SessionPolicyName)
+		return got != nil, hasPolicy && claims.MapClaims[iamPolicyClaimNameSA()] == embeddedPolicyType, u.Credentials
+	}
+	// check wants the edit applied, and the policy kept or removed.
+	check := func(t *testing.T, key string, keep bool, took func(auth.Credentials) bool) {
+		t.Helper()
+		cached, stored, cr := embedded(t, key)
+		if cached != keep || stored != keep {
+			t.Errorf("embedded policy: cached=%v stored=%v, want %v", cached, stored, keep)
+		}
+		if took != nil && !took(cr) {
+			t.Errorf("the edit did not apply: status=%q name=%q description=%q expiration=%v", cr.Status, cr.Name, cr.Description, cr.Expiration)
+		}
+	}
+
+	later := UTCNow().Add(time.Hour)
+	for _, edit := range []struct {
+		name, start string
+		opts        updateServiceAccountOpts
+		took        func(auth.Credentials) bool
+	}{
+		{"disable", auth.AccountOn, updateServiceAccountOpts{status: string(madmin.AccountDisabled)}, func(c auth.Credentials) bool { return c.Status == auth.AccountOff }},
+		{"enable", auth.AccountOff, updateServiceAccountOpts{status: string(madmin.AccountEnabled)}, func(c auth.Credentials) bool { return c.Status == auth.AccountOn }},
+		{"status-off", auth.AccountOn, updateServiceAccountOpts{status: auth.AccountOff}, func(c auth.Credentials) bool { return c.Status == auth.AccountOff }},
+		{"status-on", auth.AccountOff, updateServiceAccountOpts{status: auth.AccountOn}, func(c auth.Credentials) bool { return c.Status == auth.AccountOn }},
+		{"secret-key", auth.AccountOn, updateServiceAccountOpts{secretKey: "edit-rotated-secret"}, func(c auth.Credentials) bool { return c.SecretKey == "edit-rotated-secret" }},
+		{"name", auth.AccountOn, updateServiceAccountOpts{name: "renamed"}, func(c auth.Credentials) bool { return c.Name == "renamed" }},
+		{"description", auth.AccountOn, updateServiceAccountOpts{description: "described"}, func(c auth.Credentials) bool { return c.Description == "described" }},
+		{"expiration", auth.AccountOn, updateServiceAccountOpts{expiration: &later}, func(c auth.Credentials) bool { return c.Expiration.Equal(later) }},
+	} {
+		t.Run(edit.name, func(t *testing.T) {
+			key := "edit-" + edit.name
+			restricted(t, key, edit.start)
+			_, err := f.sys.UpdateServiceAccount(f.ctx, key, edit.opts)
+			mustIAM(t, err)
+			check(t, key, true, edit.took)
+		})
+	}
+
+	t.Run("empty-policy", func(t *testing.T) {
+		const key = "edit-empty-policy"
+		restricted(t, key, auth.AccountOn)
+		_, err := f.sys.UpdateServiceAccount(f.ctx, key, updateServiceAccountOpts{sessionPolicy: &policy.Policy{}})
+		mustIAM(t, err)
+		check(t, key, false, nil)
+	})
+
+	// A peer applies the edit as the site that took it did. The edit goes
+	// through the encoding of the wire, which is where no policy and a null
+	// one become the same.
+	for _, edit := range []struct {
+		name   string
+		update madmin.SRSvcAccUpdate
+		keep   bool
+		took   func(auth.Credentials) bool
+	}{
+		{"peer-status", madmin.SRSvcAccUpdate{Status: auth.AccountOff}, true, func(c auth.Credentials) bool { return c.Status == auth.AccountOff }},
+		{"peer-null", madmin.SRSvcAccUpdate{Description: "described", SessionPolicy: madmin.SRSessionPolicy("null")}, true, func(c auth.Credentials) bool { return c.Description == "described" }},
+		{"peer-empty", madmin.SRSvcAccUpdate{SessionPolicy: madmin.SRSessionPolicy(`{"Statement":[]}`)}, false, nil},
+	} {
+		t.Run(edit.name, func(t *testing.T) {
+			key := "edit-" + edit.name
+			restricted(t, key, auth.AccountOn)
+			edit.update.AccessKey = key
+			sent, err := json.Marshal(iamReplicationItem{SRIAMItem: madmin.SRIAMItem{
+				Type:         madmin.SRIAMItemSvcAcc,
+				SvcAccChange: &madmin.SRSvcAccChange{Update: &edit.update},
+				UpdatedAt:    UTCNow(),
+			}})
+			mustIAM(t, err)
+			var got iamReplicationItem
+			mustIAM(t, json.Unmarshal(sent, &got))
+			mustIAM(t, applyIAMReplicationItem(f.ctx, got))
+			check(t, key, edit.keep, edit.took)
+		})
+	}
+}
+
+// The same over the admin API, with what a client can send for no policy.
+func TestServiceAccountUpdateKeepsPolicy(t *testing.T) {
+	if runtime.GOOS == globalWindowsOSName {
+		t.Skip("IAM integration harness is disabled on Windows")
+	}
+	s := newTestSuiteIAM(TestSuiteCommon{serverType: "ErasureSD", signer: signerV4}, false)
+	c := &check{t, s.serverType}
+	s.SetUpSuite(c)
+	defer s.TearDownSuite(c)
+
+	ctx, cancel := context.WithTimeout(context.Background(), testDefaultTimeout)
+	defer cancel()
+
+	bucket := getRandomBucketName()
+	if err := s.client.MakeBucket(ctx, bucket, minio.MakeBucketOptions{}); err != nil {
+		c.Fatalf("bucket create error: %v", err)
+	}
+	if err := s.adm.AddCannedPolicy(ctx, "keeps-policy-parent", fmt.Appendf(nil, `{"Version":"2012-10-17","Statement":[
+{"Effect":"Allow","Action":["s3:ListBucket"],"Resource":["arn:aws:s3:::%s"]},
+{"Effect":"Allow","Action":["s3:PutObject","s3:GetObject"],"Resource":["arn:aws:s3:::%s/*"]}]}`, bucket, bucket)); err != nil {
+		c.Fatalf("policy add error: %v", err)
+	}
+	parentAK, parentSK := mustGenerateCredentials(c)
+	if err := s.adm.SetUser(ctx, parentAK, parentSK, madmin.AccountEnabled); err != nil {
+		c.Fatalf("unable to set user: %v", err)
+	}
+	if _, err := s.adm.AttachPolicy(ctx, madmin.PolicyAssociationReq{Policies: []string{"keeps-policy-parent"}, User: parentAK}); err != nil {
+		c.Fatalf("unable to attach policy: %v", err)
+	}
+
+	// The account may read objects; listing is its parent's to do.
+	svcAK, svcSK := mustGenerateCredentials(c)
+	cr, err := s.adm.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
+		Policy:     fmt.Appendf(nil, `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject"],"Resource":["arn:aws:s3:::%s/*"]}]}`, bucket),
+		TargetUser: parentAK,
+		AccessKey:  svcAK,
+		SecretKey:  svcSK,
+	})
+	if err != nil {
+		c.Fatalf("unable to create svc acc: %v", err)
+	}
+	c.mustUpload(ctx, s.client, bucket)
+	svcClient := s.getUserClient(c, cr.AccessKey, cr.SecretKey, "")
+	c.mustDownload(ctx, svcClient, bucket)
+	c.mustNotListObjects(ctx, svcClient, bucket)
+
+	info := func() madmin.InfoServiceAccountResp {
+		info, err := s.adm.InfoServiceAccount(ctx, svcAK)
+		if err != nil {
+			c.Fatalf("unable to get svc acc info: %v", err)
+		}
+		return info
+	}
+
+	_, rotatedSK := mustGenerateCredentials(c)
+	later := UTCNow().Add(time.Hour).Truncate(time.Second)
+	for _, edit := range []struct {
+		name string
+		req  madmin.UpdateServiceAccountReq
+		took func(madmin.InfoServiceAccountResp) bool
+	}{
+		{"disable", madmin.UpdateServiceAccountReq{NewStatus: "off"}, func(i madmin.InfoServiceAccountResp) bool { return i.AccountStatus == auth.AccountOff }},
+		{"enable", madmin.UpdateServiceAccountReq{NewStatus: "on"}, func(i madmin.InfoServiceAccountResp) bool { return i.AccountStatus == auth.AccountOn }},
+		{"description", madmin.UpdateServiceAccountReq{NewDescription: "described"}, func(i madmin.InfoServiceAccountResp) bool { return i.Description == "described" }},
+		{"name", madmin.UpdateServiceAccountReq{NewName: "renamed"}, func(i madmin.InfoServiceAccountResp) bool { return i.Name == "renamed" }},
+		{"expiry", madmin.UpdateServiceAccountReq{NewExpiration: &later}, func(i madmin.InfoServiceAccountResp) bool { return i.Expiration != nil && i.Expiration.Equal(later) }},
+		{"secret-key", madmin.UpdateServiceAccountReq{NewSecretKey: rotatedSK}, func(madmin.InfoServiceAccountResp) bool {
+			// The new key signs a request the embedded policy allows.
+			svcClient = s.getUserClient(c, svcAK, rotatedSK, "")
+			_, err := svcClient.StatObject(ctx, bucket, "some-object", minio.StatObjectOptions{})
+			return err == nil
+		}},
+		{"null-policy", madmin.UpdateServiceAccountReq{NewPolicy: json.RawMessage("null"), NewDescription: "null"}, func(i madmin.InfoServiceAccountResp) bool { return i.Description == "null" }},
+	} {
+		if err := s.adm.UpdateServiceAccount(ctx, svcAK, edit.req); err != nil {
+			c.Fatalf("%s: unable to update svc acc: %v", edit.name, err)
+		}
+		got := info()
+		if got.ImpliedPolicy {
+			c.Fatalf("%s: the account lost its embedded policy", edit.name)
+		}
+		if !edit.took(got) {
+			c.Fatalf("%s: the edit did not apply: %+v", edit.name, got)
+		}
+	}
+	c.mustNotListObjects(ctx, svcClient, bucket)
+
+	// An empty policy document asks for the parent's policies.
+	if err := s.adm.UpdateServiceAccount(ctx, svcAK, madmin.UpdateServiceAccountReq{NewPolicy: []byte(`{"Statement":[]}`)}); err != nil {
+		c.Fatalf("unable to remove the policy of svc acc: %v", err)
+	}
+	if !info().ImpliedPolicy {
+		c.Fatalf("an empty policy document must remove the embedded policy")
+	}
+	c.mustListObjects(ctx, svcClient, bucket)
+}