anchor.diff:                      "secretsmanager:DescribeSecret"
                   ],
                   "Resource": [
  -                    "arn:aws:secretsmanager:<region>:<account-id>:secret:<secret-name>"
  +                    "arn:aws:secretsmanager:us-west-2:<account-id>:secret:<secret-name>"
                   ]
               }
           ]
  
positive.code: 
  === Update the IAM role for EKS or `kops` Kubernetes Cluster
  
  ==== EKS Kubernetes Cluster
  EC2 worker nodes use `NodeInstanceRole` created in Step 3 of the https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html[EKS Getting Started guide]. This role must be updated to allow the worked nodes to read the secrets from Secrets Manager.
  
  
negative.code: 
  Clean up:
  
    - $ kubectl delete -f templates/pod-secretsmanager.yaml
    - $ aws secretsmanager delete-secret --secret-id testsecret --region us-west-2
    - Delete IAM role policy updates for AWS Secrets Manager
  
  == Secrets using Vault
  
  