如何解决错误""Message":"User:anonymous is notauthorized to perform: iam:PassRole on resource"

Question

I am trying to register a snapshot for my elasticsearch on AWS. My goal is to create a snapshot of elasticsearch domain on a s3 bucket. Below is the command I am using:

curl -XPUT https://vpc-xxxxxxx.ap-southeast-2.es.amazonaws.com/_snapshot/es-snapshot -d '
{
"type": "s3",
"settings": {
  "bucket": "$MY_BUCKET",
  "region": "ap-southeast-2",
  "role_arn": "arn:aws:iam::xxxx:role/es-snapshot-role"
}
}'

But I got this error:

{"Message":"User: anonymous is not authorized to perform: iam:PassRole on resource: arn:aws:iam::xxxx:role/es-snapshot-role"}

It seems like a role permission issue. I have configured the role policy as:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "es:*",
                "s3:*",
                "iam:PassRole",
                "es:ESHttpPut"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

And its trust relationship is:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "es.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

I wonder what else I missed here.

This post AccessDenied for EC2 Instance with attached IAM Role doesn't seem to relate to my issue.

Answer 1

Registering a Manual Snapshot Repository

You must register a snapshot repository with Amazon Elasticsearch Service before you can take manual index snapshots. This one-time operation requires that you sign your AWS request with credentials that are allowed to access TheSnapshotRole, as described in Manual Snapshot Prerequisites .

You can't use curl to perform this operation, because it doesn't support AWS request signing. Instead, use the sample Python client , Postman , or some other method to send a signed request to register the snapshot repository. The request takes the following form:

PUT elasticsearch-domain-endpoint/_snapshot/my-snapshot-repo
{
  "type": "s3",
  "settings": {
    "bucket": "s3-bucket-name",
    "region": "region",
    "role_arn": "arn:aws:iam::123456789012:role/TheSnapshotRole"
  }
}

Reference from AWS Documentation: Working with Amazon Elasticsearch Service Index Snapshots

Answer 2

向您的 IAM 用户添加iam:PassRole权限并尝试命令，