anchor.diff:            "Path": "/", 
             "CreateDate": "2017-11-22T20:13:39.273Z", 
             "UserId": "AIDAI6SQOXCLURVV2J7BK", 
  -          "Arn": "arn:aws:iam::091144949931:user/vault-root"
  +          "Arn": "arn:aws:iam::<account-id>:user/vault-root"
         }
     }
   
  
positive.code: 
  Create an IAM user with enough permissions to manage IAM resources. We will be using the `IAMFullAccess` policy here, but a more locked down custom policy can be provided. For an example on such policy template, refer to the Vault documentation regarding the backend's https://www.vaultproject.io/docs/secrets/aws/index.html#root-credentials-for-dynamic-iam-users[root credentials].
  
  . Crete the user:
  
    $ aws iam create-user \
         --user-name vault-root
  
negative.code:        --policy-arn arn:aws:iam::aws:policy/IAMFullAccess
  
  . Generate a access key and secret access key pair:
  +
  ```
  $ aws iam create-access-key \
       --user-name vault-root
  
  {
      "AccessKey": {
          "UserName": "vault-root", 
          "Status": "Active", 
          "CreateDate": "2017-11-22T20:14:00.682Z", 
          "SecretAccessKey": "<secret-key>", 
          "AccessKeyId": "<access-key>"
      }
  }
  ```
  
  === Setup Vault and AWS backend
  
  