anchor.diff:      region=us-east-1
     Success! Data written to: aws/config/root
   
  -. Create a aws secret backend role that has read-only permissions on EC2 instances for the account using a AWS managed policy this policy:
  +. Create a AWS secret backend role that has read-only permissions on EC2 instances for the account using a AWS managed policy this policy:
   
     $ vault write aws/roles/readonly \
       arn=arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess
     Success! Data written to: aws/roles/readonly
   
  +=== Test the Pod with IAM role
  +
   Pod will be using this role to request IAM credentials during runtime.
   
   . Create the Pod:
   
  -  $ kubectl apply -f templates/pod-with-vault.yaml 
  -  pod "aws-cli" created
  +  $ kubectl apply -f templates/deployment-with-vault.yaml
  +  deployment "vault-sidecar" created
  +
  +. Get the list of Deployment:
  +
  +  $ kubectl get deployment
  +  NAME            DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
  +  vault-sidecar   1         1         1            1           10s
  +
  +. Get the list of Pod:
  +
  +  $ kubectl get pods -l app=vault-sidecar
  +  NAME                             READY     STATUS    RESTARTS   AGE
  +  vault-sidecar-79bbc86955-wwlkb   2/2       Running   0          35s
   
   . Use AWS CLI:
   
   ```
  -$ kubectl exec -it aws-cli aws s3 ls
  +$ kubectl exec -it $(kubectl get pods -l app=vault-sidecar -o jsonpath={.items[0].metadata.name}) aws s3 ls
  +Defaulting container name to aws-cli.
  +Use 'kubectl describe pod/vault-sidecar-79bbc86955-h4pkf' to see all of the containers in this pod.
   
   An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied
   command terminated with exit code 255
   ```
   
  -. Delete the Pod:
  -
  -  $ kubectl delete po/aws-cli
  -  pod "aws-cli" deleted
  -
  -. Update the policy:
  +. Update the AWS secret backend to allow access to S3:
   
     $ vault write aws/roles/readonly \
       arn=arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
     Success! Data written to: aws/roles/readonly
   
  -. Create the Pod:
  -
  -  $ kubectl apply -f templates/pod-with-vault.yaml 
  -  pod "aws-cli" created
  +. Delete the Deployment:
  +
  +  $ kubectl delete -f templates/deployment-with-vault.yaml
  +  deployment "vault-sidecar" deleted
  +
  +. Create the Deployment again:
  +
  +  $ kubectl apply -f templates/deployment-with-vault.yaml
  +  deployment "aws-sidecar-example" created
   
   . Use AWS CLI:
   
  -```
  -$ kubectl exec -it aws-cli aws s3 ls
  -
  -An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied
  -command terminated with exit code 255
  -```
  -
  +  $ kubectl exec -it $(kubectl get pods -l app=vault-sidecar -o jsonpath={.items[0].metadata.name}) aws s3 ls
  ++
  +And this shows the listing of S3 buckets in your account.
  +
  
positive.code:       }
    }
  
  === Configure IAM role on the Pod
  
  `iam.amazonaws.com/role` annotation on the pod is used to assign an IAM role to a pod. Let's set this annotation on our pod. The `templates/pod-with-kube2iam.yaml` file looks like:
  
  
negative.code: +
  Note that the `kube2iam-ds.yaml` is assuming that your network configuration is based on `kubenet`, which is also the default kops configuration. If you have changed this as part of another exercise (e.g. switched to Calico) you will need to change the value of the `--host-interface` arg in the configuration file. For example, set to `cal+` if using Calico.
  
  === IAM roles for worker nodes
  
  It is necessary to create an IAM role which can assume other roles and assign it to each Kubernetes worker.
  
  We need the link:https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html[Amazon Resource Name (ARN)] of the IAM Role assigned to the worker nodes.  We will need this as part of creating pod roles.  We can obtain this by running the following command:
  
  