anchor.diff:  
   === Update the IAM role for EKS or `kops` Kubernetes Cluster
   
  +In this guide, we will create the secret in the US-West (Oregon) `us-west-2` region. AWS Secrets Manager is available in most AWS regions
  +
   ==== EKS Kubernetes Cluster
   EC2 worker nodes use `NodeInstanceRole` created in Step 3 of the https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html[EKS Getting Started guide]. This role must be updated to allow the worked nodes to read the secrets from Secrets Manager.
   
  
positive.code:                     "secretsmanager:DescribeSecret"
                  ],
                  "Resource": [
                      "arn:aws:secretsmanager:<region>:<account-id>:secret:<secret-name>"
                  ]
              }
          ]
  
negative.code:                     "secretsmanager:DescribeSecret"
                  ],
                  "Resource": [
                      "arn:aws:secretsmanager:us-west-2:<account-id>:secret:<secret-name>"
                  ]
              }
          ]
  