anchor.diff:  
   This will create a pod with the AWS CLI already installed, with the `MyPodRole` IAM role assigned.
   
  -Log into the `aws-cli` pod that we have just deployed:
  -
  -  $ kubectl exec -it aws-cli /bin/bash
  -  bash-4.3#
  -
  -We will use the AWS CLI to attempt to access S3.  Recall that the `MyPodRole` IAM role that we created has no permissions, therefore the following should fail:
  -
  -  bash-4.3# aws s3 ls
  -  An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied
  -
  -Exit the pod:
  -
  -  bash-4.3# exit
  -  exit
  -  command terminated with exit code 255
  +Run the AWS CLI to attempt to access S3:
  +
  +```
  +$ kubectl exec -it aws-cli aws s3 ls
  +
  +An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied
  +```
  +
  +Recall that the `MyPodRole` IAM role that we created has no permissions and so the access is denied.
   
   Terminate the pod:
   
  
positive.code:       }
    }
  
  === Configure IAM role on a Pod
  
  `iam.amazonaws.com/role` annotation on the pod is used to assign an IAM role to a pod. Let's set this annotation on our pod. The `templates/pod-with-kube2iam.yaml` file looks like:
  
  
negative.code:   $ kubectl create -f templates/pod-with-kube2iam.yaml
    pod "aws-cli" created
  
    $ kubectl exec -it aws-cli aws s3 ls
  
  The output should show the list of S3 buckets.
  
  