anchor.diff:  . Click on `Finish`.
   . Select `IAM`, `Encryption Keys`, `k8s-key` and copy the ARN of the key.
   
  +=== Update the IAM role
  +
  +The Kubernetes EC2 worker nodes use an instance profile to allow the EC2 instances to access other AWS services. This role
  +must be updated to allow the worker nodes to read the secrets from Parameter Store.
  +
  +In the IAM Console click `roles` and type `nodes` into the search box. Find the `nodes.example.cluster.k8s.local` role
  +and click it. In the Permissions tab, expand the inline policy for `nodes.example.cluster.k8s.local` and click
  +`Edit policy`. Add the `ssm:GetParameter` permission to the policy so the policy looks similar to the one below.
  +
  +{
  +    "Version": "2012-10-17",
  +    "Statement": [
  +        .
  +        .
  +        .
  +        },
  +        {
  +            "Effect": "Allow",
  +            "Action": [
  +                "ssm:GetParameter"
  +            ],
  +            "Resource": [
  +                "arn:aws:ssm:us-east-1:295744685835:parameter/GREETING",
  +                "arn:aws:ssm:us-east-1:295744685835:parameter/NAME"
  +            ]
  +        }
  +    ]
  +}
  +
   === Create secrets
   
   Only the value of the secure string parameter is encrypted. The name of the parameter, description, and other properties are not encrypted.
  
positive.code:         "Effect": "Allow",
          "Principal": {
            "AWS": [
              "arn:aws:iam::091144949931:role/nodes.example.cluster.k8s.local"
            ]
          },
          "Action": [
  
negative.code:     --name NAME \
      --value World \
      --type SecureString \
      --key-id arn:aws:kms:us-east-1:123456789012:key/414a963b-7fe4-4a61-b19f-ea408b9bda3b
    {
        "Version": 1
    }
  