anchor.diff:    capabilities = ["read"]
   }
   ```
  -
  ++
   . Mount AWS backend:
   
     $ vault mount aws
  
positive.code:       }
    }
  
  === Setup Vault
  
  . Create a policy for this role:
  
  
negative.code:   Policy 'kube-auth' written.
  
  . Check the policy:
  +
  ```
  $ vault policies kube-auth
  path "secret/creds" {
  