anchor.diff:  
   From now on, pods in the default namespace will only be able to optain the `MyPodRole`.
   
  -== IAM container roles using Hashicorp Vault (NOT WORKING)
  +== IAM container roles using Hashicorp Vault
   
   Hashicorp Vault is a tool for securely accessing secrets. The secrets could be static where they are retrieved from a key-value store or could be dynamically generated when needed such as IAM credentials. This is enabled by the pluggable architecture of Vault that supports different backends. Vault behaves like a virtual filesystem where each backend is mounted at a specific path. For example, https://www.vaultproject.io/docs/auth/aws.html[AWS backend] is mounted at the path `aws`.
   
   Each Vault backend reacts differently to different Vault CLI commands. For example, the command `vault read aws/deploy` will generate an access key based on the deploy policy.
   
  +Make sure to setup Vault as explained in:
  +
  +. link:../config-secrets#create-ec2-instance[Create EC2 instance]
  +. link:../config-secrets#start-vault-server-on-ec2[Start Vault Server on EC2]
  +. link:../config-secrets#configure-vault-cli-on-your-local-machine[Configure Vault CLI on your local machine]
  +. link:../config-secrets#configure-kubernetes-service-account[Configure Kubernetes Service Account]
  +. link:../config-secrets#configure-kubernetes-auth-backend[Configure Kubernetes Auth backend]
  +
  +And now follow the steps outlined here.
  +
  +The steps in this section are inspired from https://github.com/calvn/vault-kubernetes-demo/blob/master/5-deploy-aws.md.
  +
   === Setup AWS account
  +
  +Create an IAM user with enough permissions to manage IAM resources. We will be using the `IAMFullAccess` policy here, but a more locked down custom policy can be provided. For an example on such policy template, refer to the Vault documentation regarding the backend's https://www.vaultproject.io/docs/secrets/aws/index.html#root-credentials-for-dynamic-iam-users[root credentials].
   
   . Crete the user:
   
  
positive.code: +
  Note that the `kube2iam-ds.yaml` is assuming that your network configuration is based on `kubenet`, which is also the default kops configuration. If you have changed this as part of another exercise (e.g. switched to Calico) you will need to change the value of the `--host-interface` arg in the configuration file. For example, set to `cal+` if using Calico.
  
  === IAM Roles for worker nodes
  
  It is necessary to create an IAM role which can assume other roles and assign it to each kubernetes worker.
  
  We need the link:https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html[Amazon Resource Name (ARN)] of the IAM Role assigned to the worker nodes.  We will need this as part of creating pod roles.  We can obtain this by running the following command:
  
  
negative.code:   $ vault mount aws
    Successfully mounted 'aws' at 'aws'!
  
  . Configure the AWS secret backend:
  
    $ vault write aws/config/root \
      secret_key=<secret-key> \
  