anchor.diff:            "Path": "/", 
             "CreateDate": "2017-11-22T20:13:39.273Z", 
             "UserId": "AIDAI6SQOXCLURVV2J7BK", 
  -          "Arn": "arn:aws:iam::091144949931:user/vault-root"
  +          "Arn": "arn:aws:iam::<account-id>:user/vault-root"
         }
     }
   
  
positive.code: 
  == IAM container roles using Hashicorp Vault
  
  Hashicorp Vault is a tool for securely accessing secrets. The secrets could be static where they are retrieved from a key-value store or could be dynamically generated when needed such as IAM credentials. This is enabled by the pluggable architecture of Vault that supports different backends. Vault behaves like a virtual filesystem where each backend is mounted at a specific path. For example, https://www.vaultproject.io/docs/auth/aws.html[AWS backend] is mounted at the path `aws`.
  
  Each Vault backend reacts differently to different Vault CLI commands. For example, the command `vault read aws/deploy` will generate an access key based on the deploy policy.
  
  Make sure to setup Vault as explained in:
  
  
negative.code:     arn=arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
    Success! Data written to: aws/roles/readonly
  
  . We need to generate a new set of AWS credentials after the policy is updated. In order for this policy to take effect, we need to restart the sidecar container. But its easier to delete and create the Deployment again.
  
  that reads the credentials from Vault. This will allow the new policy to take effect. But its easier to delete the Deployment.
  
    $ kubectl delete -f templates/deployment-with-vault.yaml
    deployment "vault-sidecar" deleted
  