anchor.diff:  
   == IAM Container Roles
   
  -https://github.com/jtblin/kube2iam[Kube2iam] provides different AWS IAM roles for pods running on Kubernetes based on annotations.
  -
  -Kube2iam works by intercepting traffic from the containers to the EC2 Metadata API, calling the AWS Security Token Service (STS) API to obtain temporary credentials using the pod configured role, then using these temporary credentials to perform the original request.
  +link:https://github.com/jtblin/kube2iam[Kube2iam] provides different AWS IAM roles for pods running on Kubernetes based on annotations.
  +
  +Kube2iam works by intercepting traffic from the containers to the EC2 Metadata API, calling the link:https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html[AWS Security Token Service (STS)] API to obtain temporary credentials using the pod configured role, then using these temporary credentials to perform the original request.
   
   === Install kube2iam
   
  
positive.code: 
  We will first create a role with no permissions.  By configuring the Trusted Policy of the role, we are allowing kube2iam (via the worker node IAM Instance Profile Role) to assume the pod role.  Make note of the role ARN from the response:
  
    aws iam create-role \
      --role-name MyPodRole \
      --assume-role-policy-document \
      file://templates/pod-role-trust-policy.json
  
negative.code: 
  It is necessary to create an IAM role which can assume other roles and assign it to each kubernetes worker.
  
  We need the link:https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html[Amazon Resource Name (ARN)] of the IAM Role assigned to the worker nodes.  We will need this as part of creating pod roles.  We can obtain this by running the following command:
  
    $ kubectl get no \
      --selector=kubernetes.io/role==node \
      -o jsonpath='{.items[0].spec.externalID}' | \
      xargs aws ec2 describe-instances \
  