anchor.diff:  
   1. Replace `YOUR-AWS-BUILDPACK-BUCKET`, `YOUR-AWS-DROPLET-BUCKET`, `YOUR-AWS-PACKAGE-BUCKET`, and `YOUR-AWS-RESOURCE-BUCKET` with the names of your AWS buckets. Do not use periods (`.`) in your AWS bucket names. In the AWS console, you must assign your credentials an IAM policy that allows all S3 actions on all of these buckets. 
   
  -1. You can provide further configuration through the <code>fog_connection</code> hash, which is passed through to the Fog gem.
  +1. You can provide further configuration through the `fog_connection` hash, which is passed through to the Fog gem.
   
   1. `fog_aws_storage_options` takes a hash with the key `encryption`. Operators can set its value to a type of encryption algorithm. In the configuration information above, `encryption` is set to `AES256` to enable AWS SSE-S3 encryption. 
   
  
positive.code:       name: cloud-controller-iam
      ```
  
  1. In your Cloud Foundry deployment manifest use the `cloud-controller-iam` vm_extension you created for the instance groups containing cloud_controller, cloud_controller_worker, and cloud_controller_clock (for example in cf_deployment: api, cc-clock, and scheduler instance groups).
  
      ```
      instance_groups:
  
negative.code: 
  ##<a id="fog-gcs-service-account"></a>Fog with Google Cloud Storage Service Accounts
  
  To configure your blobstore to use Google Cloud Storage with a service account, do the following:
  
  1. Create a custom Cloud IAM role with the following permissions:
  
  