fix: STS creds without "aud" should be honored with STS checks (#8868)

Fixes #8865

cmd/iam.go

@@ -1367,8 +1367,13 @@ func (sys *IAMSys) IsAllowed(args iampolicy.Args) bool {
 		return true
 	}
 
-	// With claims set, we should do STS related checks and validation.
+	// If the credential is temporary, perform STS related checks.
-	if _, ok := args.Claims["aud"]; ok {
+	ok, err := sys.IsTempUser(args.AccountName)
+	if err != nil {
+		logger.LogIf(context.Background(), err)
+		return false
+	}
+	if ok {
 		return sys.IsAllowedSTS(args)
 	}