anchor.diff:  
   All configuration files for this chapter are in the `roles` directory.
   
  -== IAM Roles for Master Nodes
  -
  -Out of the box, when deploying Kubernetes on AWS, master nodes require a number of EC2, Elastic Load Balancer (ELB), EC2 Container Registry (ECR), Route53, and Key Management Service (KMS) policies applied. The worker nodes require a number of EC2, ECR, and Route53 policies applied.  If using `kops` to install, these will be automatically configured for you (see link:https://github.com/kubernetes/kops/blob/master/docs/iam_roles.md[here] for a full list).
  +== IAM Roles for master nodes
  +
  +Kubernetes cluster created using kops has two IAM roles - one for all master nodes and one for all worker nodes. The master IAM role is associated with a number of policies related to EC2, Elastic Load Balancer (ELB), EC2 Container Registry (ECR), Route53, and Key Management Service (KMS). The worker nodes require a number of EC2, ECR, and Route53 policies applied. Kops automatically configures these roles and policies for you (see link:https://github.com/kubernetes/kops/blob/master/docs/iam_roles.md[here] for a full list).
   
   These policies may be augmented via `kops`.  For example, to allow all nodes ElasticSearch access, perform the following steps:
   
  
positive.code: 
  AWS uses Identity and Access Management (IAM) roles to manage authentication and authorization for AWS Services.  An IAM role is an IAM entity that defines a set of permissions for making AWS service requests. For more information about IAM, please see link:https://aws.amazon.com/iam/details/[here].
  
  Out of the box, Kubernetes supports two types of roles: a master IAM role and a node IAM role.
  
  In addition, the 3rd party plugin https://github.com/jtblin/kube2iam[kube2iam] can be configured to apply IAM roles at the pod level.
  
  This exercise will walk you through configuring both concepts.
  
  == Prerequisites
  
  
negative.code:     namespace "default" configured
  
  From now on, pods in the default namespace will only be able to optain the `MyPodRole`.
  
  