OpenSearch snapshots repo registration error: User: anonymous is not authorized to perform: iam:PassRole

Question

Hi

I want to create index snapshots in Amazon OpenSearch. I followed the instructions shown in https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html.

But when I ran the following command in the dashboard - Dev Tools,

```
PUT _snapshot/snapshot-repo
{
  "type": "s3",
  "settings": {
    "bucket": "opensearch-snapshot",
    "region": "us-gov-east-1",
    "role_arn": "arn:aws-us-gov:iam::123456789012:role/AmazonOpenSearchSnapshotRole"
  }
}
```

I got the following error:

```
{
  "Message": "User: anonymous is not authorized to perform: iam:PassRole on resource: arn:aws-us-gov:iam::123456789012:role/AmazonOpenSearchSnapshotRole because no resource-based policy allows the iam:PassRole action"
}
```

I mapped the snapshot role as shown in https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshot-registerdirectory.html#managedomains-snapshot-fgac.

Fine-grained access control is enabled, and Master user type is "Internal user database".

I signed in to the AWS account using Identity Center user which has administrative access, and admin user which has "all_access" role to the dashboard.

The domain access policy is as follows.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "es:*",
      "Resource": "arn:aws-us-gov:es:us-gov-east-1:123456789012:domain/gov-opensearch/*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "iam:PassRole",
      "Resource": "arn:aws-us-gov:iam::123456789012:role/AmazonOpenSearchSnapshotRole"
    }
  ]
}
```

Thanks.

Sonic · Accepted Answer

For guidance on IAM user and role creation, please refer to this video: https://www.youtube.com/watch?v=KeUBwm-aalU. Then I used Postman for the API calls to resolve the issue.

re:Post Agent · Answer

The error you're encountering is related to authentication and permissions when trying to register a snapshot repository in Amazon OpenSearch Service with fine-grained access control enabled.

When using fine-grained access control, there's an additional step required beyond just mapping the role in the dashboard. Even if you're using HTTP basic authentication (which appears to be the case since you're using the internal user database for master user), you need to make a signed request to register the snapshot repository.

The "User: anonymous" error indicates that your request to register the repository is not properly authenticated with AWS credentials that have the necessary permissions. When you're using the Dev Tools console in OpenSearch Dashboards, you're essentially making an unsigned request as an "anonymous" user from AWS's perspective, even though you're logged into the dashboard.

Here's what you need to do:

1. Ensure you have an IAM role with the proper permissions to pass the snapshot role (iam:PassRole).

2. Map the `manage_snapshots` role to the IAM role that has these permissions in OpenSearch Dashboards:
- Go to Security > Roles > manage_snapshots
- Choose Mapped users > Manage mapping
- Add the ARN of your IAM role under Backend roles

3. Instead of using Dev Tools to register the repository, use a signed request with AWS Signature Version 4 authentication. You can do this using a script or tool that can sign requests with your AWS credentials.

The domain access policy you've set allows any principal to perform iam:PassRole, but this doesn't override the need for a properly authenticated request. The request must be signed with credentials from an IAM role that has been mapped to the manage_snapshots role in OpenSearch Dashboards.

For domains with fine-grained access control, you cannot register a snapshot repository directly through the Dev Tools console without proper AWS authentication, even if you're logged in as an admin user in the dashboard.  
**Sources**  
[Fine-grained access control in Amazon OpenSearch Service - Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html)  
[Registering a manual snapshot repository - Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshot-registerdirectory.html)  
[Create and schedule manual snapshots in OpenSearch Service | AWS re:Post](https://repost.aws/knowledge-center/opensearch-create-schedule-manual-snapshots)  
[Creating index snapshots in Amazon OpenSearch Service - Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-snapshots.html)

OpenSearch snapshots repo registration error: User: anonymous is not authorized to perform: iam:PassRole

Add your answer

Relevant content