anchor.diff:  
   == IAM container roles using Hashicorp Vault
   
  -Hashicorp Vault is a tool for securely accessing secrets. The secrets could be static where they are retrieved from a key-value store or could be dynamically generated when needed such as IAM credentials. This is enabled by the pluggable architecture of Vault that supports different backends. Vault behaves like a virtual filesystem where each backend is mounted at a specific path. For example, https://www.vaultproject.io/docs/auth/aws.html[AWS backend] is mounted at the path `aws`.
  -
  -Each Vault backend reacts differently to different Vault CLI commands. For example, the command `vault read aws/deploy` will generate an access key based on the deploy policy.
  +Hashicorp Vault is a tool for securely accessing secrets. The secrets could be static where they are retrieved from a key-value store or could be dynamically generated when needed such as IAM credentials. This is enabled by the pluggable architecture of Vault that supports different backends. Vault behaves like a virtual filesystem where each backend is mounted at a specific path. For example, by default, https://www.vaultproject.io/docs/auth/aws.html[AWS backend] is mounted at the path `aws`. An alternative path can be specified using `-path` at mount time.
  +
  +Each Vault backend reacts differently to different Vault CLI commands. For example, the command `vault read aws/deploy` will generate an access key based on the `"deploy"` role in the context of Vault/AWS secret backend. This role contains an IAM role or ARN mapping.
   
   Make sure to setup Vault as explained in:
   
  
positive.code: +
  And this shows the listing of S3 buckets in your account.
  +
  . Kubernetes Auth backend is configured for the token to expire in 60 seconds. This means the temporary IAM role created for this Deployment will eventually disappear. Trying to access the S3 listing after a few minutes will give an error:
  +
  ```
  $ kubectl exec -it $(kubectl get pods -l app=vault-sidecar -o jsonpath={.items[0].metadata.name}) aws s3 ls
  
negative.code:     arn=arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
    Success! Data written to: aws/roles/readonly
  
  . We need to generate a new set of AWS credentials after the policy is updated. In order for this policy to take effect, we need to restart the sidecar container. But its easier to delete and create the Deployment again.
  
  that reads the credentials from Vault. This will allow the new policy to take effect. But its easier to delete the Deployment.
  
    $ kubectl delete -f templates/deployment-with-vault.yaml
    deployment "vault-sidecar" deleted
  