anchor.diff:    $ kubectl create -f templates/pod-with-kube2iam.yaml
     pod "aws-cli" created
   
  -  $ kubectl exec -it aws-cli /bin/bash
  -  bash-4.3# aws s3 ls
  +  $ kubectl exec -it aws-cli aws s3 ls
   
   The output should show the list of S3 buckets.
   
  
positive.code:       }
    }
  
  === Configure IAM role on a Pod
  
  `iam.amazonaws.com/role` annotation on the pod is used to assign an IAM role to a pod. Let's set this annotation on our pod. The `templates/pod-with-kube2iam.yaml` file looks like:
  
  
negative.code: 
  This will create a pod with the AWS CLI already installed, with the `MyPodRole` IAM role assigned.
  
  Run the AWS CLI to attempt to access S3:
  
  ```
  $ kubectl exec -it aws-cli aws s3 ls
  
  An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied
  ```
  
  Recall that the `MyPodRole` IAM role that we created has no permissions and so the access is denied.
  
  Terminate the pod:
  
  