diff --git a/tests/commands/create_bucket.sh b/tests/commands/create_bucket.sh
index cbf19f9f..dd26af9f 100644
--- a/tests/commands/create_bucket.sh
+++ b/tests/commands/create_bucket.sh
@@ -35,6 +35,30 @@ create_bucket() {
   return 0
 }
 
+create_bucket_with_user() {
+  if [ $# -ne 4 ]; then
+    log 2 "create bucket missing command type, bucket name, access, secret"
+    return 1
+  fi
+  local exit_code=0
+  if [[ $1 == "aws" ]] || [[ $1 == "s3api" ]]; then
+    error=$(AWS_ACCESS_KEY_ID="$3" AWS_SECRET_ACCESS_KEY="$4" aws --no-verify-ssl s3 mb s3://"$2" 2>&1) || exit_code=$?
+  elif [[ $1 == "s3cmd" ]]; then
+    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate mb --access_key="$3" --secret_key="$4" s3://"$2" 2>&1) || exit_code=$?
+  elif [[ $1 == "mc" ]]; then
+    error=$(mc --insecure mb "$MC_ALIAS"/"$2" 2>&1) || exit_code=$?
+  else
+    log 2 "invalid command type $1"
+    return 1
+  fi
+  if [ $exit_code -ne 0 ]; then
+    log 2 "error creating bucket: $error"
+    export error
+    return 1
+  fi
+  return 0
+}
+
 create_bucket_object_lock_enabled() {
   record_command "create-bucket" "client:s3api"
   if [ $# -ne 1 ]; then
diff --git a/tests/commands/get_bucket_acl.sh b/tests/commands/get_bucket_acl.sh
index 69ab489a..224a0a9f 100644
--- a/tests/commands/get_bucket_acl.sh
+++ b/tests/commands/get_bucket_acl.sh
@@ -19,6 +19,7 @@ get_bucket_acl() {
     log 2 "Error getting bucket ACLs: $acl"
     return 1
   fi
+  acl=$(echo "$acl" | grep -v "InsecureRequestWarning")
   export acl
 }
 
diff --git a/tests/commands/list_buckets.sh b/tests/commands/list_buckets.sh
index a6cb249c..25678e7d 100644
--- a/tests/commands/list_buckets.sh
+++ b/tests/commands/list_buckets.sh
@@ -11,7 +11,7 @@ list_buckets() {
   if [[ $1 == 's3' ]]; then
     buckets=$(aws --no-verify-ssl s3 ls 2>&1 s3://) || exit_code=$?
   elif [[ $1 == 's3api' ]] || [[ $1 == 'aws' ]]; then
-    list_buckets_s3api || exit_code=$?
+    list_buckets_s3api "$AWS_ACCESS_KEY_ID" "$AWS_SECRET_ACCESS_KEY" || exit_code=$?
   elif [[ $1 == 's3cmd' ]]; then
     buckets=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate ls s3:// 2>&1) || exit_code=$?
   elif [[ $1 == 'mc' ]]; then
@@ -38,12 +38,54 @@ list_buckets() {
   return 0
 }
 
+list_buckets_with_user() {
+  record_command "list-buckets" "client:$1"
+  if [ $# -ne 3 ]; then
+    echo "'list buckets as user' command missing command type, username, password"
+    return 1
+  fi
+
+  local exit_code=0
+  if [[ $1 == 's3' ]]; then
+    buckets=$(AWS_ACCESS_KEY_ID="$2" AWS_SECRET_ACCESS_KEY="$3" aws --no-verify-ssl s3 ls 2>&1 s3://) || exit_code=$?
+  elif [[ $1 == 's3api' ]] || [[ $1 == 'aws' ]]; then
+    list_buckets_s3api "$2" "$3" || exit_code=$?
+  elif [[ $1 == 's3cmd' ]]; then
+    buckets=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate --access_key="$2" --secret_key="$3" ls s3:// 2>&1) || exit_code=$?
+  elif [[ $1 == 'mc' ]]; then
+    buckets=$(mc --insecure ls "$MC_ALIAS" 2>&1) || exit_code=$?
+  else
+    echo "list buckets command not implemented for '$1'"
+    return 1
+  fi
+  if [ $exit_code -ne 0 ]; then
+    echo "error listing buckets: $buckets"
+    return 1
+  fi
+
+  if [[ $1 == 's3api' ]] || [[ $1 == 'aws' ]]; then
+    return 0
+  fi
+
+  bucket_array=()
+  while IFS= read -r line; do
+    bucket_name=$(echo "$line" | awk '{print $NF}')
+    bucket_array+=("${bucket_name%/}")
+  done <<< "$buckets"
+  export bucket_array
+  return 0
+}
+
 list_buckets_s3api() {
-  output=$(aws --no-verify-ssl s3api list-buckets 2>&1) || exit_code=$?
-  if [[ $exit_code -ne 0 ]]; then
+  if [[ $# -ne 2 ]]; then
+    log 2 "'list_buckets_s3api' requires username, password"
+    return 1
+  fi
+  if ! output=$(AWS_ACCESS_KEY_ID="$1" AWS_SECRET_ACCESS_KEY="$2" aws --no-verify-ssl s3api list-buckets 2>&1); then
     echo "error listing buckets: $output"
     return 1
   fi
+  log 5 "bucket data: $output"
 
   modified_output=""
   while IFS= read -r line; do
diff --git a/tests/commands/put_bucket_acl.sh b/tests/commands/put_bucket_acl.sh
index 3f6cd933..25e2ee15 100644
--- a/tests/commands/put_bucket_acl.sh
+++ b/tests/commands/put_bucket_acl.sh
@@ -1,35 +1,38 @@
 #!/usr/bin/env bash
 
-put_bucket_acl() {
+put_bucket_acl_s3api() {
   record_command "put-bucket-acl" "client:$1"
   if [[ $# -ne 3 ]]; then
     log 2 "put bucket acl command requires command type, bucket name, acls or username"
     return 1
   fi
-  local error=""
-  local put_result=0
-  if [[ $1 == 's3api' ]]; then
-    log 5 "bucket name: $2, acls: $3"
-    error=$(aws --no-verify-ssl s3api put-bucket-acl --bucket "$2" --access-control-policy "file://$3" 2>&1) || put_result=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate setacl "s3://$2" --acl-grant=read:"$3" 2>&1) || put_result=$?
-  else
-    log 2 "put_bucket_acl not implemented for '$1'"
-    return 1
-  fi
-  if [[ $put_result -ne 0 ]]; then
+  log 5 "bucket name: $2, acls: $3"
+  if ! error=$(aws --no-verify-ssl s3api put-bucket-acl --bucket "$2" --access-control-policy "file://$3" 2>&1); then
     log 2 "error putting bucket acl: $error"
     return 1
   fi
   return 0
 }
 
+put_bucket_canned_acl_s3cmd() {
+  record_command "put-bucket-acl" "client:s3cmd"
+  if [[ $# -ne 2 ]]; then
+    log 2 "put bucket acl command requires bucket name, permission"
+    return 1
+  fi
+  if ! error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate setacl "s3://$1" "$2" 2>&1); then
+    log 2 "error putting s3cmd canned ACL:  $error"
+    return 1
+  fi
+  return 0
+}
+
 put_bucket_canned_acl() {
-  record_command "put-bucket-acl" "client:s3api"
   if [[ $# -ne 2 ]]; then
     log 2 "'put bucket canned acl' command requires bucket name, canned ACL"
     return 1
   fi
+  record_command "put-bucket-acl" "client:s3api"
   if ! error=$(aws --no-verify-ssl s3api put-bucket-acl --bucket "$1" --acl "$2" 2>&1); then
     log 2 "error re-setting bucket acls: $error"
     return 1
@@ -38,11 +41,11 @@ put_bucket_canned_acl() {
 }
 
 put_bucket_canned_acl_with_user() {
-  record_command "put-bucket-acl" "client:s3api"
-  if [[ $# -ne 2 ]]; then
+  if [[ $# -ne 4 ]]; then
     log 2 "'put bucket canned acl with user' command requires bucket name, canned ACL, username, password"
     return 1
   fi
+  record_command "put-bucket-acl" "client:s3api"
   if ! error=$(AWS_ACCESS_KEY_ID="$3" AWS_SECRET_ACCESS_KEY="$4" aws --no-verify-ssl s3api put-bucket-acl --bucket "$1" --acl "$2" 2>&1); then
     log 2 "error re-setting bucket acls: $error"
     return 1
diff --git a/tests/commands/put_public_access_block.sh b/tests/commands/put_public_access_block.sh
new file mode 100644
index 00000000..676999b5
--- /dev/null
+++ b/tests/commands/put_public_access_block.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+put_public_access_block() {
+  if [[ $# -ne 2 ]]; then
+    log 2 "'put_public_access_block' command requires bucket, access block list"
+    return 1
+  fi
+  if ! error=$(aws --no-verify-ssl s3api put-public-access-block --bucket "$1" --public-access-block-configuration "$2"); then
+    log 2 "error updating public access block: $error"
+    return 1
+  fi
+}
+
+put_public_access_block_enable_public_acls() {
+  if [[ $# -ne 1 ]]; then
+    log 2 "command requires bucket"
+    return 1
+  fi
+  if ! put_public_access_block "$1" "BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=true,RestrictPublicBuckets=true"; then
+    log 2 "error putting public acccess block"
+    return 1
+  fi
+  return 0
+}
+
+put_public_access_block_disable_public_acls() {
+  if [[ $# -ne 1 ]]; then
+    log 2 "command requires bucket"
+    return 1
+  fi
+  if ! put_public_access_block "$1" "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"; then
+    log 2 "error putting public access block"
+    return 1
+  fi
+  return 0
+}
+
diff --git a/tests/env.sh b/tests/env.sh
index f2605989..1e91bcc1 100644
--- a/tests/env.sh
+++ b/tests/env.sh
@@ -92,6 +92,9 @@ check_universal_vars() {
   if [[ -n "$DIRECT" ]]; then
     export DIRECT
   fi
+  if [[ -n "$DIRECT_DISPLAY_NAME" ]]; then
+    export DIRECT_DISPLAY_NAME
+  fi
   if [[ -n "$COVERAGE_DB" ]]; then
     export COVERAGE_DB
   fi
diff --git a/tests/test_aws.sh b/tests/test_aws.sh
index e28ecbbc..789456c9 100755
--- a/tests/test_aws.sh
+++ b/tests/test_aws.sh
@@ -29,6 +29,7 @@ source ./tests/commands/put_object.sh
 source ./tests/commands/put_object_legal_hold.sh
 source ./tests/commands/put_object_lock_configuration.sh
 source ./tests/commands/put_object_retention.sh
+source ./tests/commands/put_public_access_block.sh
 source ./tests/commands/select_object_content.sh
 
 export RUN_USERS=true
@@ -988,6 +989,74 @@ EOF
   delete_test_files "$policy_file" "$test_file"
 }
 
+@test "test_policy_put_acl" {
+  if [[ $DIRECT != "true" ]]; then
+    # https://github.com/versity/versitygw/issues/702
+    skip
+  fi
+
+  policy_file="policy_file"
+  test_file="test_file"
+  username="ABCDEFG"
+  password="HIJLKMN"
+
+  create_test_files "$policy_file" || fail "error creating policy file"
+  create_large_file "$test_file" || fail "error creating large file"
+  setup_bucket "s3api" "$BUCKET_ONE_NAME" || fail "error setting up bucket"
+
+  put_bucket_ownership_controls "$BUCKET_ONE_NAME" "BucketOwnerPreferred" || fail "error putting bucket ownership controls"
+
+  if [[ $DIRECT == "true" ]]; then
+    setup_user_direct "$username" "user" "$BUCKET_ONE_NAME" || fail "error setting up direct user $username"
+    principal="{\"AWS\": \"arn:aws:iam::$DIRECT_AWS_USER_ID:user/$username\"}"
+    # shellcheck disable=SC2154
+    username=$key_id
+    # shellcheck disable=SC2154
+    password=$secret_key
+  else
+    password="HIJLKMN"
+    setup_user "$username" "$password" "user" || fail "error setting up user $username"
+    principal="\"$username\""
+  fi
+
+  cat <<EOF > "$test_file_folder"/$policy_file
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": $principal,
+      "Action": "s3:PutBucketAcl",
+      "Resource": "arn:aws:s3:::$BUCKET_ONE_NAME"
+    }
+  ]
+}
+EOF
+  if [[ $DIRECT == "true" ]]; then
+    put_public_access_block_enable_public_acls "$BUCKET_ONE_NAME" || fail "error enabling public ACLs"
+  fi
+
+  put_bucket_policy "s3api" "$BUCKET_ONE_NAME" "$test_file_folder/$policy_file" || fail "error putting policy"
+  put_bucket_canned_acl_with_user "$BUCKET_ONE_NAME" "public-read" "$username" "$password" || fail "error putting canned acl"
+
+  get_bucket_acl "s3api" "$BUCKET_ONE_NAME" || fail "error getting bucket acl"
+  # shellcheck disable=SC2154
+  log 5 "ACL: $acl"
+  second_grant=$(echo "$acl" | jq -r ".Grants[1]" 2>&1) || fail "error getting second grant: $second_grant"
+  second_grantee=$(echo "$second_grant" | jq -r ".Grantee" 2>&1) || fail "error getting second grantee: $second_grantee"
+  permission=$(echo "$second_grant" | jq -r ".Permission" 2>&1) || fail "error getting permission: $permission"
+  log 5 "second grantee: $second_grantee"
+  [[ $permission == "READ" ]] || fail "incorrect permission: $permission"
+  if [[ $DIRECT == "true" ]]; then
+    uri=$(echo "$second_grantee" | jq -r ".URI" 2>&1) || fail "error getting uri: $uri"
+    [[ $uri == "http://acs.amazonaws.com/groups/global/AllUsers" ]] || fail "unexpected URI: $uri"
+  else
+    id=$(echo "$second_grantee" | jq -r ".ID" 2>&1) || fail "error getting ID: $id"
+    [[ $id == "$username" ]] || fail "unexpected ID: $id"
+  fi
+  delete_bucket_or_contents "aws" "$BUCKET_ONE_NAME"
+}
+
 @test "test_put_object_lock_configuration" {
   bucket_name=$BUCKET_ONE_NAME
   if [[ $RECREATE_BUCKETS == "true" ]]; then
@@ -998,6 +1067,7 @@ EOF
   local governance="GOVERNANCE"
   local days="1"
   put_object_lock_configuration "$bucket_name" "$enabled" "$governance" "$days" || fail "error putting object lock configuration"
+
   get_object_lock_configuration "$bucket_name" || fail "error getting object lock configuration"
   log 5 "LOCK CONFIG: $lock_config"
   object_lock_configuration=$(echo "$lock_config" | jq -r ".ObjectLockConfiguration" 2>&1) || fail "error getting ObjectLockConfiguration: $object_lock_configuration"
diff --git a/tests/test_common.sh b/tests/test_common.sh
index ab9f84bb..72a3ceee 100644
--- a/tests/test_common.sh
+++ b/tests/test_common.sh
@@ -17,6 +17,7 @@ source ./tests/commands/put_bucket_acl.sh
 source ./tests/commands/put_bucket_tagging.sh
 source ./tests/commands/put_object_tagging.sh
 source ./tests/commands/put_object.sh
+source ./tests/commands/put_public_access_block.sh
 
 test_common_multipart_upload() {
   if [[ $# -ne 1 ]]; then
@@ -422,6 +423,54 @@ test_common_get_bucket_location() {
   [[ $bucket_location == "null" ]] || [[ $bucket_location == "us-east-1" ]] || fail "wrong location: '$bucket_location'"
 }
 
+test_put_bucket_acl_s3cmd() {
+  if [[ $DIRECT != "true" ]]; then
+    # https://github.com/versity/versitygw/issues/695
+    skip
+  fi
+  setup_bucket  "s3cmd" "$BUCKET_ONE_NAME" || fail "error creating bucket"
+  put_bucket_ownership_controls "$BUCKET_ONE_NAME" "BucketOwnerPreferred" || fail "error putting bucket ownership controls"
+
+  username="abcdefgh"
+  if [[ $DIRECT != "true" ]]; then
+    setup_user "$username" "HIJKLMN" "user" || fail "error creating user"
+  fi
+  sleep 5
+
+  get_bucket_acl "s3cmd" "$BUCKET_ONE_NAME" || fail "error retrieving acl"
+  log 5 "Initial ACLs: $acl"
+  acl_line=$(echo "$acl" | grep "ACL")
+  user_id=$(echo "$acl_line" | awk '{print $2}')
+  if [[ $DIRECT == "true" ]]; then
+    [[ $user_id == "$DIRECT_DISPLAY_NAME:" ]] || fail "ID mismatch ($user_id, $DIRECT_DISPLAY_NAME)"
+  else
+    [[ $user_id == "$AWS_ACCESS_KEY_ID:" ]] || fail "ID mismatch ($user_id, $AWS_ACCESS_KEY_ID)"
+  fi
+  permission=$(echo "$acl_line" | awk '{print $3}')
+  [[ $permission == "FULL_CONTROL" ]] || fail "Permission mismatch ($permission)"
+
+  if [[ $DIRECT == "true" ]]; then
+    put_public_access_block_enable_public_acls "$BUCKET_ONE_NAME" || fail "error enabling public ACLs"
+  fi
+  put_bucket_canned_acl_s3cmd "$BUCKET_ONE_NAME" "--acl-public" || fail "error putting canned s3cmd ACL"
+
+  get_bucket_acl "s3cmd" "$BUCKET_ONE_NAME" || fail "error retrieving acl"
+  log 5 "ACL after read put: $acl"
+  acl_lines=$(echo "$acl" | grep "ACL")
+  log 5 "ACL lines:  $acl_lines"
+  while IFS= read -r line; do
+    lines+=("$line")
+  done <<< "$acl_lines"
+  log 5 "lines: ${lines[*]}"
+  [[ ${#lines[@]} -eq 2 ]] || fail "unexpected number of ACL lines: ${#lines[@]}"
+  anon_name=$(echo "${lines[1]}" | awk '{print $2}')
+  anon_permission=$(echo "${lines[1]}" | awk '{print $3}')
+  [[ $anon_name == "*anon*:" ]] || fail "unexpected anon name: $anon_name"
+  [[ $anon_permission == "READ" ]] || fail "unexpected anon permission: $anon_permission"
+
+  delete_bucket_or_contents "s3cmd" "$BUCKET_ONE_NAME"
+}
+
 test_common_put_bucket_acl() {
   [[ $# -eq 1 ]] || fail "test common put bucket acl missing command type"
   setup_bucket  "$1" "$BUCKET_ONE_NAME" || fail "error creating bucket"
@@ -434,23 +483,26 @@ test_common_put_bucket_acl() {
 
   log 5 "Initial ACLs: $acl"
   id=$(echo "$acl" | grep -v "InsecureRequestWarning" | jq -r '.Owner.ID' 2>&1) || fail "error getting ID: $id"
-  if [[ $id != "$username" ]]; then
+  if [[ $id != "$AWS_ACCESS_KEY_ID" ]]; then
     # for direct, ID is canonical user ID rather than AWS_ACCESS_KEY_ID
-    canonical_id=$(aws --no-verify-ssl s3api list-buckets --query 'Owner.ID' 2>&1) || fail "error getting caononical ID: $canonical_id"
-    [[ $id == "$AWS_ACCESS_KEY_ID" ]] || fail "acl ID doesn't match AWS key or canonical ID"
+    canonical_id=$(aws --no-verify-ssl s3api list-buckets --query 'Owner.ID' 2>&1) || fail "error getting canonical ID: $canonical_id"
+    [[ $id == "$canonical_id" ]] || fail "acl ID doesn't match AWS key or canonical ID"
   fi
 
   acl_file="test-acl"
   create_test_files "$acl_file"
 
+  if [[ $DIRECT == "true" ]]; then
+    grantee="{\"Type\": \"Group\", \"URI\": \"http://acs.amazonaws.com/groups/global/AllUsers\"}"
+  else
+    grantee="{\"ID\": \"$username\", \"Type\": \"CanonicalUser\"}"
+  fi
+
 cat <<EOF > "$test_file_folder"/"$acl_file"
   {
     "Grants": [
       {
-        "Grantee": {
-          "ID": "$username",
-          "Type": "CanonicalUser"
-        },
+        "Grantee": $grantee,
         "Permission": "READ"
       }
     ],
@@ -461,12 +513,7 @@ cat <<EOF > "$test_file_folder"/"$acl_file"
 EOF
 
   log 6 "before 1st put acl"
-  if [[ $1 == 's3api' ]] || [[ $1 == 'aws' ]]; then
-    put_bucket_acl "$1" "$BUCKET_ONE_NAME" "$test_file_folder"/"$acl_file" || fail "error putting first acl"
-  else
-    put_bucket_acl "$1" "$BUCKET_ONE_NAME" "$username" || fail "error putting first acl"
-  fi
-
+  put_bucket_acl_s3api "$1" "$BUCKET_ONE_NAME" "$test_file_folder"/"$acl_file" || fail "error putting first acl"
   get_bucket_acl "$1" "$BUCKET_ONE_NAME" || fail "error retrieving second ACL"
 
   log 5 "Acls after 1st put: $acl"
@@ -491,8 +538,7 @@ cat <<EOF > "$test_file_folder"/"$acl_file"
   }
 EOF
 
-  put_bucket_acl "$1" "$BUCKET_ONE_NAME" "$test_file_folder"/"$acl_file" || fail "error putting second acl"
-
+  put_bucket_acl_s3api "$1" "$BUCKET_ONE_NAME" "$test_file_folder"/"$acl_file" || fail "error putting second acl"
   get_bucket_acl "$1" "$BUCKET_ONE_NAME" || fail "error retrieving second ACL"
 
   log 5 "Acls after 2nd put: $acl"
diff --git a/tests/test_s3cmd.sh b/tests/test_s3cmd.sh
index 6a8f03a3..07fa9eea 100755
--- a/tests/test_s3cmd.sh
+++ b/tests/test_s3cmd.sh
@@ -73,9 +73,9 @@ export RUN_USERS=true
   test_common_put_object_no_data "s3cmd"
 }
 
-#@test "test_put_bucket_acl" {
-#  test_common_put_bucket_acl "s3cmd"
-#}
+@test "test_put_bucket_acl" {
+  test_put_bucket_acl_s3cmd
+}
 
 # test listing buckets on versitygw
 @test "test_list_buckets_s3cmd" {
diff --git a/tests/test_user_common.sh b/tests/test_user_common.sh
index 0f0de7bb..64109353 100755
--- a/tests/test_user_common.sh
+++ b/tests/test_user_common.sh
@@ -4,6 +4,7 @@ source ./tests/setup.sh
 source ./tests/util_users.sh
 source ./tests/util.sh
 source ./tests/util_bucket_create.sh
+source ./tests/commands/list_buckets.sh
 
 test_admin_user() {
   if [[ $# -ne 1 ]]; then
diff --git a/tests/util.sh b/tests/util.sh
index eca81cc6..ae35d711 100644
--- a/tests/util.sh
+++ b/tests/util.sh
@@ -412,35 +412,6 @@ check_and_put_object() {
   return 0
 }
 
-list_buckets_with_user() {
-  if [[ $# -ne 3 ]]; then
-    echo "List buckets command missing format, user id, key"
-    return 1
-  fi
-
-  local exit_code=0
-  local output
-  if [[ $1 == "aws" ]]; then
-    output=$(AWS_ACCESS_KEY_ID="$2" AWS_SECRET_ACCESS_KEY="$3" aws --no-verify-ssl s3 ls s3:// 2>&1) || exit_code=$?
-  else
-    echo "invalid format:  $1"
-    return 1
-  fi
-
-  if [ $exit_code -ne 0 ]; then
-    echo "error listing buckets: $output"
-    return 1
-  fi
-
-  bucket_array=()
-  while IFS= read -r line; do
-    bucket_name=$(echo "$line" | awk '{print $NF}')
-    bucket_array+=("${bucket_name%/}")
-  done <<< "$output"
-
-  export bucket_array
-}
-
 remove_insecure_request_warning() {
   if [[ $# -ne 1 ]]; then
     echo "remove insecure request warning requires input lines"
diff --git a/tests/util_bucket_create.sh b/tests/util_bucket_create.sh
index 1bb4f893..2193847d 100644
--- a/tests/util_bucket_create.sh
+++ b/tests/util_bucket_create.sh
@@ -3,30 +3,6 @@
 source ./tests/util_mc.sh
 source ./tests/logger.sh
 
-create_bucket_with_user() {
-  if [ $# -ne 4 ]; then
-    log 2 "create bucket missing command type, bucket name, access, secret"
-    return 1
-  fi
-  local exit_code=0
-  if [[ $1 == "aws" ]]; then
-    error=$(AWS_ACCESS_KEY_ID="$3" AWS_SECRET_ACCESS_KEY="$4" aws --no-verify-ssl s3 mb s3://"$2" 2>&1) || exit_code=$?
-  elif [[ $1 == "s3cmd" ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate mb --access_key="$3" --secret_key="$4" s3://"$2" 2>&1) || exit_code=$?
-  elif [[ $1 == "mc" ]]; then
-    error=$(mc --insecure mb "$MC_ALIAS"/"$2" 2>&1) || exit_code=$?
-  else
-    log 2 "invalid command type $1"
-    return 1
-  fi
-  if [ $exit_code -ne 0 ]; then
-    log 2 "error creating bucket: $error"
-    export error
-    return 1
-  fi
-  return 0
-}
-
 create_bucket_invalid_name() {
   if [ $# -ne 1 ]; then
     log 2 "create bucket w/invalid name missing command type"
diff --git a/tests/util_users.sh b/tests/util_users.sh
index d79c6fc3..65907384 100644
--- a/tests/util_users.sh
+++ b/tests/util_users.sh
@@ -61,35 +61,43 @@ create_user_if_nonexistent() {
   return $?
 }
 
-put_user_policy() {
-  if [[ $# -ne 3 ]]; then
-    log 2 "attaching user policy requires user ID, role, bucket name"
+put_user_policy_userplus() {
+  if [[ $# -ne 1 ]]; then
+    log 2 "'put user policy userplus' function requires username"
     return 1
   fi
-  if [[ -z "$test_file_folder" ]]; then
-    log 2 "no test folder defined"
-    return 1
-  fi
-
-  # TODO add other roles
-  if [[ $2 != "user" ]]; then
-    log 2 "role for '$2' not currently supported"
+  if [[ -z "$test_file_folder" ]] && [[ -z "$GITHUB_ACTIONS" ]] && ! create_test_file_folder; then
+    log 2 "unable to create test file folder"
     return 1
   fi
+          #"Resource": "arn:aws:s3:::${aws:username}-*"
 
 cat <<EOF > "$test_file_folder"/user_policy_file
 {
   "Version": "2012-10-17",
   "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": "*",
-      "Resource": "arn:aws:s3:::$3/*"
-    }
+      {
+          "Effect": "Allow",
+          "Action": [
+              "s3:CreateBucket",
+              "s3:ListBucket",
+              "s3:ListAllMyBuckets",
+              "s3:ListBucketMultipartUploads",
+              "s3:GetBucketLocation"
+          ],
+          "Resource": "arn:aws:s3:::$1-*"
+      },
+      {
+          "Effect": "Allow",
+          "Action": "s3:*",
+          "Resource": [
+              "arn:aws:s3:::$1-*",
+              "arn:aws:s3:::$1-*/*"
+          ]
+      }
   ]
 }
 EOF
-
   if ! error=$(aws iam put-user-policy --user-name "$1" --policy-name "UserPolicy" --policy-document "file://$test_file_folder/user_policy_file" 2>&1); then
     log 2 "error putting user policy: $error"
     return 1
@@ -97,6 +105,29 @@ EOF
   return 0
 }
 
+put_user_policy() {
+  if [[ $# -ne 3 ]]; then
+    log 2 "attaching user policy requires user ID, role, bucket name"
+    return 1
+  fi
+  if [[ -z "$test_file_folder" ]] && [[ -z "$GITHUB_ACTIONS" ]] && ! create_test_file_folder; then
+    log 2 "unable to create test file folder"
+    return 1
+  fi
+
+  case $2 in
+  "user")
+    ;;
+  "userplus")
+    if ! put_user_policy_userplus "$1"; then
+      log 2 "error adding userplus policy"
+      return 1
+    fi
+    ;;
+  esac
+  return 0
+}
+
 create_user_direct() {
   if [[ $# -ne 3 ]]; then
     log 2 "create user direct command requires desired username, role, bucket name"
@@ -272,11 +303,25 @@ delete_user() {
   fi
 }
 
+change_bucket_owner_direct() {
+  if [[ $# -ne 4 ]]; then
+    echo "change bucket owner command requires ID, key, bucket name, and new owner"
+    return 1
+  fi
+
+}
+
 change_bucket_owner() {
   if [[ $# -ne 4 ]]; then
     echo "change bucket owner command requires ID, key, bucket name, and new owner"
     return 1
   fi
+  if [[ $DIRECT == "true" ]]; then
+    if ! change_bucket_owner_direct "$1" "$2" "$3" "$4"; then
+      log 2 "error changing bucket owner direct to s3"
+      return 1
+    fi
+  fi
   error=$($VERSITY_EXE admin --allow-insecure --access "$1" --secret "$2" --endpoint-url "$AWS_ENDPOINT_URL" change-bucket-owner --bucket "$3" --owner "$4" 2>&1) || local change_result=$?
   if [[ $change_result -ne 0 ]]; then
     echo "error changing bucket owner: $error"