anchor.diff:  export BUILDKITE_S3_DEFAULT_REGION="eu-central-1" # default: us-east-1
   ```
   
  -You will also need to make sure your agent instances have the following IAM
  -policy to read and write objects in the bucket, for example:
  +### Permissions
  +
  +You will need to make sure your agent instances have the following IAM policy to
  +read and write objects in the bucket, for example:
   
   ```json
   {
  
positive.code: export BUILDKITE_S3_ACCESS_URL="https://buildkite-artifacts.example.com/"
  ```
  
  See the BUILDKITE&#95;S3&#95;ACL variable in the
  [environment variables list](/docs/pipelines/environment-variables#bk-env-vars)
  for a full list of access control options.
  
  
negative.code: `ArtifactsBucket` template parameter for an appropriate IAM policy to be
  included in the instance’s IAM role.
  
  ### Credentials
  
  If you’re running your agents on an AWS EC2 Instance we suggest adding the above
  policy to [an IAM Role](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html).
  If you're running outside of AWS, or you’re unable to use an instance role, you
  