anchor.diff:  
   Clean up:
   
  -  $ kubectl delete -f templates/pod-secretsmanager.yaml
  -  $ aws secretsmanager delete-secret --secret-id testsecret --region us-west-2
  +  - $ kubectl delete -f templates/pod-secretsmanager.yaml
  +  - $ aws secretsmanager delete-secret --secret-id testsecret --region us-west-2
  +  - Delete IAM role policy updates for AWS Secrets Manager
   
   == Secrets using Vault
   
  
positive.code:                     "secretsmanager:DescribeSecret"
                  ],
                  "Resource": [
                      "arn:aws:secretsmanager:<region>:<account-id>:secret:<secret-name>"
                  ]
              }
          ]
  
negative.code: 
  === Update the IAM role for EKS or `kops` Kubernetes Cluster
  
  In this guide, we will create the secret in the US-West (Oregon) `us-west-2` region. AWS Secrets Manager is available in most AWS regions
  
  ==== EKS Kubernetes Cluster
  EC2 worker nodes use `NodeInstanceRole` created in Step 3 of the https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html[EKS Getting Started guide]. This role must be updated to allow the worked nodes to read the secrets from Secrets Manager.
  
  