func checkKeyValid(r *http.Request, accessKey string) (auth.Credentials, bool, APIErrorCode) {
	if !globalIAMSys.Initialized() && !globalIsGateway {
		// Check if server has initialized, then only proceed
		// to check for IAM users otherwise its okay for clients
		// to retry with 503 errors when server is coming up.
		return auth.Credentials{}, false, ErrServerNotInitialized
	}

	var owner = true
	var cred = globalActiveCred
	if cred.AccessKey != accessKey {
		// Check if the access key is part of users credentials.
		ucred, ok := globalIAMSys.GetUser(accessKey)
		if !ok {
			return cred, false, ErrInvalidAccessKeyID
		}
		cred = ucred
	}

	claims, s3Err := checkClaimsFromToken(r, cred)
	if s3Err != ErrNone {
		return cred, false, s3Err
	}

	if len(claims) > 0 {
		cred.Claims = claims

		// Now check if we have a sessionPolicy.
		if _, ok := claims[iampolicy.SessionPolicyName]; ok {
			owner = false
		} else {
			owner = cred.AccessKey == cred.ParentUser
		}
	}

	return cred, owner, ErrNone
}
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.