anchor.diff:  
   If you want to work with an AWS account, you can simply remove or comment out all Amazon KMS related properties. By default, the KMS client extension
   will use the `default` credentials provider chain that looks for credentials in this order:
  -- Java System Properties - `aws.accessKeyId` and `aws.secretKey`
  +
  +* Java System Properties - `aws.accessKeyId` and `aws.secretAccessKey`
   * Environment Variables - `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`
   * Credential profiles file at the default location (`~/.aws/credentials`) shared by all AWS SDKs and the AWS CLI
  -* Credentials delivered through the Amazon EC2 container service if the `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` environment variable is set and the security manager has permission to access the variable,
  +* Credentials delivered through the Amazon ECS if the `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` environment variable is set and the security manager has permission to access the variable,
   * Instance profile credentials delivered through the Amazon EC2 metadata service
   
   And the region from your AWS CLI profile will be used.
  
positive.code: In this example, we will create an application that allows to encrypt and decrypt text message provided in the request.
  The example application will demonstrate the two programming models supported by the extension.
  
  Lets create a `org.acme.kms.QuarkusKmsSyncResource` that will provide an API to encrypt and decrypt message using the synchronous client.
  
  [source,java]
  ----
  
negative.code: ----
  MASTER_KEY_ARN=`aws kms create-key --profile localstack --endpoint-url=http://localhost:8011 | cut -f3`
  ----
  Generate a key data as 256-bit symmetric key (AES 256)
  [source,shell,subs="verbatim,attributes"]
  ----
  aws kms generate-data-key --key-id $MASTER_KEY_ARN --key-spec AES_256 --profile localstack --endpoint-url=http://localhost:8011
  