anchor.diff:  
   Update the cluster for changes to take effect:
   
  -  kops update cluster example.cluster.k8s.local --yes
  +  $ kops update cluster example.cluster.k8s.local --yes
   
   In a similar fashion, policies may be applied to all masters by setting the `additionalPolicies.master` property as below:
   
  
positive.code: 
  . Edit your cluster using the command:
  
    kops edit cluster example.cluster.k8s.local
  
  . Update the `spec` to allow STS to assume roles:
  
  
negative.code: 
  == IAM Container Roles
  
  link:https://github.com/jtblin/kube2iam[Kube2iam] provides different AWS IAM roles for pods running on Kubernetes based on annotations.
  
  Kube2iam works by intercepting traffic from the containers to the EC2 Metadata API, calling the link:https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html[AWS Security Token Service (STS)] API to obtain temporary credentials using the pod configured role, then using these temporary credentials to perform the original request.
  
  === Install kube2iam
  
  