OpenSearch S3 Snapshot Fails with iam:PassRole Error Using Internal User

Question

I have an Amazon OpenSearch domain configured with internal users only (no IAM users or Cognito). I’m trying to set up snapshot backups to an S3 bucket.

I followed the AWS documentation and created the following IAM role:
arn:aws:iam:::role/opensearch-snapshot-role

The trust policy:
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "es.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```
The permissions policy attached to the role:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:DeleteObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::opensearch.backup",
        "arn:aws:s3:::opensearch.backup/*"
      ]
    }
  ]
}
```
However, when trying to register the snapshot repository via Dev Tools (logged in as the OpenSearch master user), I get this error:
```
{
  "Message": "User: anonymous is not authorized to perform: iam:PassRole on resource: arn:aws:iam:::role/opensearch-snapshot-role because no resource-based policy allows the iam:PassRole action"
}
```
How can I allow internal users (especially the master user) to perform the iam:PassRole required to use this role for snapshots?

Do I need to attach a resource-based policy somewhere else or configure something differently since I’m not using IAM-authenticated users?

re:Post Agent · Answer

The error you're encountering is related to permissions required for passing an IAM role to the OpenSearch service. When using internal users (fine-grained access control) with OpenSearch, there's still a need to properly configure IAM permissions for certain operations like S3 snapshots.

To resolve the "not authorized to perform: iam:PassRole" error, you need to:

1. Create or modify an IAM user/role that you'll use to make the API call to register the snapshot repository.

2. Attach a policy to this IAM user/role that explicitly allows the `iam:PassRole` permission for your snapshot role. The policy should look similar to:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam:::role/opensearch-snapshot-role"
},
{
"Effect": "Allow",
"Action": "es:ESHttpPut",
"Resource": "arn:aws:es:::domain//*"
}
]
}
```

3. Instead of using the OpenSearch dashboard's Dev Tools to register the repository, you'll need to use the AWS SDK or CLI with the IAM credentials of the user/role that has the PassRole permission.

The key issue is that when using internal users in OpenSearch, those users don't have AWS IAM permissions. The "anonymous" in the error message indicates that the request isn't being made with valid IAM credentials that have the PassRole permission. Even though you're authenticated to the OpenSearch dashboard as the master user, that authentication doesn't provide IAM permissions.

For operations that require IAM permissions like registering an S3 snapshot repository, you need to use AWS credentials with the appropriate IAM permissions outside of the OpenSearch dashboard interface.  
**Sources**  
[Creating index snapshots in Amazon OpenSearch Service - Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html)  
[Resolve the IAM error "not authorized to perform iam:PassRole" | AWS re:Post](https://repost.aws/knowledge-center/iam-passrole-error)

OpenSearch S3 Snapshot Fails with iam:PassRole Error Using Internal User

Add your answer

Relevant content