anchor.diff:        "Statement": [{
           "Effect": "Allow",
           "Action": [ "s3:*" ],
  -        "Resource": [ "arn:aws:s3:::<bosh_bucket_name>/*" ]
  +        "Resource": [
  +          "arn:aws:s3:::<bosh_bucket_name>",
  +          "arn:aws:s3:::<bosh_bucket_name>/*",
  +        ]
         }]
       }
       ```
  
positive.code:       aws: &aws
          credentials_source: env_or_profile
          # access_key_id and secret_access_key are not provided
          ...
      ```
  
      <p class="note">Note: To use IAM instance profile as a credentials source when using bosh-init, you have to run bosh-init from a [jump box](terminology.html#jumpbox), an existing AWS instance with IAM instance profile (you can reuse `director` IAM role). Alternatively if you are deploying the Director VM from outside of the AWS, you can use hard coded credentials with bosh-init and have the AWS CPI on the Director VM use IAM instance profile as a credentials source.</p>
  
negative.code:       },{
          "Effect": "Allow",
          "Action": [ "s3:*" ],
          "Resource": [
            "arn:aws:s3:::<bosh_bucket_name>",
            "arn:aws:s3:::<bosh_bucket_name>/*",
          ]
        }]
      }
      ```
  