anchor.diff:  
   We will first create a role with no permissions.  By configuring the Trusted Policy of the role, we are allowing kube2iam (via the worker node IAM Instance Profile Role) to assume the pod role.  Make note of the role ARN from the response:
   
  -  aws iam create-role \
  +  $ aws iam create-role \
       --role-name MyPodRole \
       --assume-role-policy-document \
       file://templates/pod-role-trust-policy.json
  
positive.code: = Kubernetes Applying IAM Roles
  :toc:
  
  Out of the box, Kubernetes supports 2 types of roles: a master IAM role and a node IAM role.
  
  In addition, the 3rd party plugin https://github.com/jtblin/kube2iam[kube2iam] can be configured to apply IAM roles at the pod level.
  
  This excerise will walk you through configuring both concepts.
  
  == Pre-requisites
  
  A 3 master nodes and 5 worker nodes cluster as explained at link:../cluster-install#multi-master-multi-node-multi-az-gossip-based-cluster[] is used for this chapter.
  
  All configuration files for this chapter are in the `roles` directory.
  
  == IAM Master / Node Roles
  
  Out of the box, when deploying Kubernetes on AWS, master nodes require a number of EC2, Elastic Load Balancer (ELB), EC2 Container Registry (ECR), Route53 and KMS policies applied. The worker nodes require a number of EC2, ECR and Route53 policies applied.  If using `kops` to install, these will be auotmatically configured for you (see https://github.com/kubernetes/kops/blob/master/docs/iam_roles.md[here] for a full list).
  
  These policies may be augmented via kops.  For example, to allow all nodes ElasticSearch access, perform the following steps:
  
  Edit your cluster using the command:
  
    kops edit cluster example.cluster.k8s.local
  
  Add the following to the `spec`:
  
  
negative.code: 
  == IAM Container Roles
  
  link:https://github.com/jtblin/kube2iam[Kube2iam] provides different AWS IAM roles for pods running on Kubernetes based on annotations.
  
  Kube2iam works by intercepting traffic from the containers to the EC2 Metadata API, calling the link:https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html[AWS Security Token Service (STS)] API to obtain temporary credentials using the pod configured role, then using these temporary credentials to perform the original request.
  
  === Install kube2iam
  
  