anchor.diff:  
   ### <a id='public-networks-example'></a>Public Networks ###
   
  -Public network connectivity is often required by applications to retrieve application dependencies or to integrate with services available on public networks. Example application dependencies include public Maven repositories, NPM, RubyGems, Docker registries and others.
  -
  -<p class='note'><strong>Note</strong>: It is strongly recommended to exclude IaaS metadata endpoints, such as 169.254.169.254, because the metadata endpoint could expose sensitive environment information to untrusted applications. The `public_networks` example below accounts for this recommendation.
  +Applications often require public network connectivity to retrieve application dependencies or to integrate with services available on public networks. Example application dependencies include public Maven repositories, NPM, RubyGems, Docker registries and others.
  +
  +<p class='note'><strong>Note</strong>: Exclude IaaS metadata endpoints, such as 169.254.169.254, because the metadata endpoint can expose sensitive environment information to untrusted applications. The <code>public_networks</code> example below accounts for this recommendation.</p>
   
   Example `public_networks` ASG:
   
  
positive.code: 
  ## <a id='typical-groups'></a>Typical Application Security Groups ##
  
  Below are examples of typical ASGs. Your ASGs should be configured in
  accordance with your organization’s network access policy for untrusted
  applications.
  
  
negative.code: 
  ## <a id='updating-groups'></a>Updating Application Security Groups ##
  
  <p class='note'><strong>Note</strong>: Updating an ASG does not affect started applications until you restart them.</p>
  
  To update an existing ASG, run the following command, replacing `SECURITY-GROUP` with the name of your security group and `PATH-TO-RULES-FILE` with the absolute or relative path to a rules file.
  <pre class="terminal">
  