diff --git a/src/minio.rs b/src/minio.rs
index 94a992c..ebb0fbc 100644
--- a/src/minio.rs
+++ b/src/minio.rs
@@ -25,6 +25,8 @@ enum MinioError {
     SetRetentionFailed,
     #[error("Failed to set policy!")]
     ApplyPolicyFailed,
+    #[error("Failed to create user!")]
+    CreateUserFailed,
 }
 
 #[derive(Debug, Clone)]
@@ -110,6 +112,12 @@ struct PolicyInfo {
     Policy: serde_json::Value,
 }
 
+#[allow(non_snake_case)]
+#[derive(Debug, Clone, Deserialize)]
+struct MinioUserListRes {
+    accessKey: String,
+}
+
 impl BasicMinioResult {
     pub fn success(&self) -> bool {
         self.status == "success"
@@ -474,11 +482,42 @@ impl MinioService {
 
         Ok(serde_json::to_string(&policy.policyInfo.Policy)?)
     }
+
+    /// Apply a user
+    pub async fn user_apply(&self, user: &MinioUser) -> anyhow::Result<()> {
+        let res = self
+            .exec_mc_cmd::<BasicMinioResult>(&[
+                "admin",
+                "user",
+                "add",
+                MC_ALIAS_NAME,
+                user.username.as_str(),
+                user.password.as_str(),
+            ])
+            .await?;
+
+        if res.get(0).map(|r| r.success()) != Some(true) {
+            return Err(MinioError::CreateUserFailed.into());
+        }
+
+        Ok(())
+    }
+
+    /// Get the list of users
+    pub async fn user_list(&self) -> anyhow::Result<Vec<String>> {
+        Ok(self
+            .exec_mc_cmd::<MinioUserListRes>(&["admin", "user", "list", MC_ALIAS_NAME])
+            .await?
+            .iter()
+            .map(|p| p.accessKey.to_string())
+            .collect())
+    }
 }
 
 #[cfg(test)]
 mod test {
     use crate::crd::{BucketRetention, MinioBucketSpec, RetentionType};
+    use crate::minio::MinioUser;
     use crate::minio_test_server::MinioTestServer;
 
     const TEST_BUCKET_NAME: &str = "mybucket";
@@ -943,14 +982,52 @@ mod test {
 
         assert_ne!(policy_1, policy_2);
 
-        assert!(!service.policy_list().await.unwrap().contains(&TEST_POLICY_NAME.to_string()));
+        assert!(!service
+            .policy_list()
+            .await
+            .unwrap()
+            .contains(&TEST_POLICY_NAME.to_string()));
 
-        service.policy_apply(TEST_POLICY_NAME, &policy_1).await.unwrap();
-        assert!(service.policy_list().await.unwrap().contains(&TEST_POLICY_NAME.to_string()));
-        assert_eq!(unify_policy(&service.policy_content(TEST_POLICY_NAME).await.unwrap()), policy_1);
+        service
+            .policy_apply(TEST_POLICY_NAME, &policy_1)
+            .await
+            .unwrap();
+        assert!(service
+            .policy_list()
+            .await
+            .unwrap()
+            .contains(&TEST_POLICY_NAME.to_string()));
+        assert_eq!(
+            unify_policy(&service.policy_content(TEST_POLICY_NAME).await.unwrap()),
+            policy_1
+        );
 
-        service.policy_apply(TEST_POLICY_NAME, &policy_2).await.unwrap();
-        assert!(service.policy_list().await.unwrap().contains(&TEST_POLICY_NAME.to_string()));
-        assert_eq!(unify_policy(&service.policy_content(TEST_POLICY_NAME).await.unwrap()), policy_2);
+        service
+            .policy_apply(TEST_POLICY_NAME, &policy_2)
+            .await
+            .unwrap();
+        assert!(service
+            .policy_list()
+            .await
+            .unwrap()
+            .contains(&TEST_POLICY_NAME.to_string()));
+        assert_eq!(
+            unify_policy(&service.policy_content(TEST_POLICY_NAME).await.unwrap()),
+            policy_2
+        );
+    }
+
+    #[tokio::test]
+    async fn policy_user() {
+        let _ = env_logger::builder().is_test(true).try_init();
+
+        let srv = MinioTestServer::start().await.unwrap();
+        let service = srv.as_service();
+
+        let user = MinioUser::gen_random();
+
+        assert!(!service.user_list().await.unwrap().contains(&user.username));
+        service.user_apply(&user).await.unwrap();
+        assert!(service.user_list().await.unwrap().contains(&user.username));
     }
 }