anchor.diff:          "Effect": "Allow",
           "Principal": {
             "AWS": [
  -            "arn:aws:iam::091144949931:root"
  +            "arn:aws:iam::123456789012:root"
             ]
           },
           "Action": "kms:*",
  
positive.code:         "Effect": "Allow",
          "Principal": {
            "AWS": [
              "arn:aws:iam::091144949931:role/nodes.example.cluster.k8s.local"
            ]
          },
          "Action": [
  
negative.code: . Click on `Finish`.
  . Select `IAM`, `Encryption Keys`, `k8s-key` and copy the ARN of the key.
  
  === Update the IAM role
  
  The Kubernetes EC2 worker nodes use an instance profile to allow the EC2 instances to access other AWS services. This role
  must be updated to allow the worker nodes to read the secrets from Parameter Store.
  
  In the IAM Console click `roles` and type `nodes` into the search box. Find the `nodes.example.cluster.k8s.local` role
  and click it. In the Permissions tab, expand the inline policy for `nodes.example.cluster.k8s.local` and click
  `Edit policy`. Add the `ssm:GetParameter` permission to the policy so the policy looks similar to the one below.
  
  {
      "Version": "2012-10-17",
      "Statement": [
          .
          .
          .
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ssm:GetParameter"
              ],
              "Resource": [
                  "arn:aws:ssm:us-east-1:295744685835:parameter/GREETING",
                  "arn:aws:ssm:us-east-1:295744685835:parameter/NAME"
              ]
          }
      ]
  }
  
  === Create secrets
  
  Only the value of the secure string parameter is encrypted. The name of the parameter, description, and other properties are not encrypted.
  