From 6c14e20a307e54ab673c7e8d11ed1179c737c100 Mon Sep 17 00:00:00 2001
From: Chris Lu <chris.lu@gmail.com>
Date: Wed, 8 Apr 2026 12:57:14 -0700
Subject: [PATCH] Add group inline policy actions to IAM docs and MinIO
 comparison

---
 AWS-IAM-CLI.md             | 38 ++++++++++++++++++++++++++++++++++++++
 Amazon-IAM-API.md          |  4 ++++
 Supported-APIs-vs-Minio.md |  8 ++++----
 3 files changed, 46 insertions(+), 4 deletions(-)

diff --git a/AWS-IAM-CLI.md b/AWS-IAM-CLI.md
index ae566fc..5f642a6 100644
--- a/AWS-IAM-CLI.md
+++ b/AWS-IAM-CLI.md
@@ -408,6 +408,44 @@ aws --endpoint $AWS_ENDPOINT iam attach-group-policy \
 aws --endpoint $AWS_ENDPOINT iam list-attached-group-policies --group-name developers
 ```
 
+### Group Inline Policies
+
+Groups can also have inline policies attached directly:
+
+```bash
+# Attach an inline policy to a group
+cat > group-policy.json << 'EOF'
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:Get*", "s3:List*"],
+      "Resource": ["arn:aws:s3:::shared-bucket/*"]
+    }
+  ]
+}
+EOF
+
+aws --endpoint $AWS_ENDPOINT iam put-group-policy \
+  --group-name developers \
+  --policy-name SharedBucketReadOnly \
+  --policy-document file://group-policy.json
+
+# List inline policies for a group
+aws --endpoint $AWS_ENDPOINT iam list-group-policies --group-name developers
+
+# Get an inline policy
+aws --endpoint $AWS_ENDPOINT iam get-group-policy \
+  --group-name developers \
+  --policy-name SharedBucketReadOnly
+
+# Delete an inline policy from a group
+aws --endpoint $AWS_ENDPOINT iam delete-group-policy \
+  --group-name developers \
+  --policy-name SharedBucketReadOnly
+```
+
 ### Detach Policy from Group
 
 ```bash
diff --git a/Amazon-IAM-API.md b/Amazon-IAM-API.md
index c58cbad..c9d5b20 100644
--- a/Amazon-IAM-API.md
+++ b/Amazon-IAM-API.md
@@ -80,6 +80,10 @@ weed iam -filer=localhost:8888 -port=8111
 | `AttachGroupPolicy` | Attach managed policy to group | Admin only |
 | `DetachGroupPolicy` | Remove managed policy from group | Admin only |
 | `ListAttachedGroupPolicies` | List managed policies for group | Admin only |
+| `PutGroupPolicy` | Attach inline policy to group | Admin only |
+| `GetGroupPolicy` | Get group's inline policy | Admin only |
+| `DeleteGroupPolicy` | Remove inline policy from group | Admin only |
+| `ListGroupPolicies` | List inline policy names for group | Admin only |
 | `ListGroupsForUser` | List groups a user belongs to | Admin only |
 | `UpdateGroup` | Rename or enable/disable a group (SeaweedFS extension) | Admin only |
 
diff --git a/Supported-APIs-vs-Minio.md b/Supported-APIs-vs-Minio.md
index 7b311ba..e9badb4 100644
--- a/Supported-APIs-vs-Minio.md
+++ b/Supported-APIs-vs-Minio.md
@@ -125,10 +125,10 @@ For group management specifically, MinIO supports broadly similar administration
 | `iam:ListAttachedGroupPolicies` | ✅ | ⚠️ Proprietary | No dedicated MinIO API; exposed via group info / policy mapping queries |
 | `iam:ListGroupsForUser` | ✅ | ⚠️ Proprietary | No dedicated MinIO API; returned as `MemberOf` in user info |
 | `iam:UpdateGroup` | ✅ | ⚠️ Partial | SeaweedFS extension: rename or enable/disable. MinIO only supports enable/disable via `set-group-status` |
-| `iam:PutGroupPolicy` | 📋 Planned | ❌ | Group inline policies; MinIO only supports managed policies |
-| `iam:GetGroupPolicy` | 📋 Planned | ❌ | |
-| `iam:DeleteGroupPolicy` | 📋 Planned | ❌ | |
-| `iam:ListGroupPolicies` | 📋 Planned | ❌ | |
+| `iam:PutGroupPolicy` | ✅ | ❌ | Group inline policies; MinIO only supports managed policies |
+| `iam:GetGroupPolicy` | ✅ | ❌ | |
+| `iam:DeleteGroupPolicy` | ✅ | ❌ | |
+| `iam:ListGroupPolicies` | ✅ | ❌ | |
 | `iam:GetAccessKeyLastUsed` | 📋 Planned | ❌ | Return when an access key was last used |
 | `iam:TagUser` | 📋 Planned | ❌ | Add tags to a user |
 | `iam:UntagUser` | 📋 Planned | ❌ | Remove tags from a user |