anchor.diff:  .Required EC2 permissions for installation
   [%collapsible]
   ====
  -* `ec2:AllocateAddress`
  -* `ec2:AssociateAddress`
   * `ec2:AuthorizeSecurityGroupEgress`
   * `ec2:AuthorizeSecurityGroupIngress`
   * `ec2:CopyImage`
  
positive.code: * `ec2:DeleteVpcEndpoints`
  * `ec2:DetachInternetGateway`
  * `ec2:DisassociateRouteTable`
  * `ec2:ReplaceRouteTableAssociation`
  
  [NOTE]
  =====
  If you use an existing VPC, your account does not require these permissions to delete network resources. Instead, your account only requires the `tag:UntagResources` permission to delete network resources.
  =====
  ====
  
  .Additional IAM and S3 permissions that are required to create manifests
  
negative.code: .Required permissions for creating network resources during installation
  [%collapsible]
  ====
  * `ec2:AllocateAddress`
  * `ec2:AssociateAddress`
  * `ec2:AssociateDhcpOptions`
  * `ec2:AssociateRouteTable`
  * `ec2:AttachInternetGateway`
  