anchor.diff:        "Statement": [{
           "Effect": "Allow",
           "Action": [ "s3:*" ],
  -        "Resource": [ "arn:aws:s3:::<bosh_bucket_name>/*" ]
  +        "Resource": [
  +          "arn:aws:s3:::<bosh_bucket_name>",
  +          "arn:aws:s3:::<bosh_bucket_name>/*",
  +        ]
         }]
       }
       ```
  
positive.code:       },{
          "Effect": "Allow",
          "Action": [ "s3:*" ],
          "Resource": [ "arn:aws:s3:::<bosh_bucket_name>/*" ]
        }]
      }
      ```
  
negative.code:       aws: &aws
          credentials_source: env_or_profile
          default_iam_instance_profile: deployed-vm
          # ...
      ```
  
      <p class="note">Note: <code>iam_instance_profile</code> key in resource pool's cloud_properties takes precedence over the default IAM instance profile, so that specific VMs can have greater access to the AWS resources.</p>
  