diff --git a/weed/shell/command_s3_helpers.go b/weed/shell/command_s3_helpers.go
index 3507975b5..4851f9fca 100644
--- a/weed/shell/command_s3_helpers.go
+++ b/weed/shell/command_s3_helpers.go
@@ -1,23 +1,11 @@
 package shell
 
+import "strings"
+
 // joinMax joins up to max strings with ", " and appends "..." if truncated.
 func joinMax(items []string, max int) string {
 	if len(items) <= max {
-		result := ""
-		for i, s := range items {
-			if i > 0 {
-				result += ", "
-			}
-			result += s
-		}
-		return result
+		return strings.Join(items, ", ")
 	}
-	result := ""
-	for i := 0; i < max; i++ {
-		if i > 0 {
-			result += ", "
-		}
-		result += items[i]
-	}
-	return result + "..."
+	return strings.Join(items[:max], ", ") + "..."
 }
diff --git a/weed/shell/command_s3_iam_export.go b/weed/shell/command_s3_iam_export.go
index d1f78e7c1..d72907f6e 100644
--- a/weed/shell/command_s3_iam_export.go
+++ b/weed/shell/command_s3_iam_export.go
@@ -44,7 +44,7 @@ func (c *commandS3IAMExport) Do(args []string, commandEnv *CommandEnv, writer io
 	f := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	file := f.String("file", "", "output file path (stdout if omitted)")
 	if err := f.Parse(args); err != nil {
-		return nil
+		return err
 	}
 
 	return pb.WithGrpcClient(false, 0, func(conn *grpc.ClientConn) error {
diff --git a/weed/shell/command_s3_iam_import.go b/weed/shell/command_s3_iam_import.go
index 9499bc79b..1252557d4 100644
--- a/weed/shell/command_s3_iam_import.go
+++ b/weed/shell/command_s3_iam_import.go
@@ -45,7 +45,7 @@ func (c *commandS3IAMImport) Do(args []string, commandEnv *CommandEnv, writer io
 	f := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	file := f.String("file", "", "input JSON file")
 	if err := f.Parse(args); err != nil {
-		return nil
+		return err
 	}
 
 	if *file == "" {
diff --git a/weed/shell/command_s3_user_provision.go b/weed/shell/command_s3_user_provision.go
index 07c0ac36b..877c3ff64 100644
--- a/weed/shell/command_s3_user_provision.go
+++ b/weed/shell/command_s3_user_provision.go
@@ -48,8 +48,8 @@ func (c *commandS3UserProvision) HasTag(CommandTag) bool {
 }
 
 var rolePolicies = map[string][]string{
-	"readonly":  {"s3:GetObject", "s3:ListBucket"},
-	"readwrite": {"s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"},
+	"readonly":  {"s3:GetObject"},
+	"readwrite": {"s3:GetObject", "s3:PutObject", "s3:DeleteObject"},
 	"admin":     {"s3:*"},
 }
 
@@ -59,7 +59,7 @@ func (c *commandS3UserProvision) Do(args []string, commandEnv *CommandEnv, write
 	bucket := f.String("bucket", "", "bucket name")
 	role := f.String("role", "", "role: readonly, readwrite, or admin")
 	if err := f.Parse(args); err != nil {
-		return nil
+		return err
 	}
 
 	if *name == "" {
@@ -80,6 +80,10 @@ func (c *commandS3UserProvision) Do(args []string, commandEnv *CommandEnv, write
 	policyName := fmt.Sprintf("%s-%s-%s", *bucket, *name, *role)
 
 	// Build the policy document
+	bucketActions := []string{"s3:ListBucket"}
+	if *role == "admin" {
+		bucketActions = []string{"s3:*"}
+	}
 	policyDoc := map[string]interface{}{
 		"Version": "2012-10-17",
 		"Statement": []map[string]interface{}{
@@ -90,7 +94,7 @@ func (c *commandS3UserProvision) Do(args []string, commandEnv *CommandEnv, write
 			},
 			{
 				"Effect":   "Allow",
-				"Action":   []string{"s3:ListBucket"},
+				"Action":   bucketActions,
 				"Resource": []string{fmt.Sprintf("arn:aws:s3:::%s", *bucket)},
 			},
 		},