title: How to solve the error ""Message":"User: anonymous is not authorized to perform: iam:PassRole on resource"
body: <p>I am trying to register a snapshot for my elasticsearch on AWS. My goal is to create a snapshot of elasticsearch domain on a s3 bucket. Below is the command I am using:</p>
  
  <pre><code>curl -XPUT https://vpc-xxxxxxx.ap-southeast-2.es.amazonaws.com/_snapshot/es-snapshot -d '
  {
  "type": "s3",
  "settings": {
    "bucket": "$MY_BUCKET",
    "region": "ap-southeast-2",
    "role_arn": "arn:aws:iam::xxxx:role/es-snapshot-role"
  }
  }'
  </code></pre>
  
  <p>But I got this error:</p>
  
  <pre><code>{"Message":"User: anonymous is not authorized to perform: iam:PassRole on resource: arn:aws:iam::xxxx:role/es-snapshot-role"}
  </code></pre>
  
  <p>It seems like a role permission issue. I have configured the role policy as:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "",
              "Effect": "Allow",
              "Action": [
                  "es:*",
                  "s3:*",
                  "iam:PassRole",
                  "es:ESHttpPut"
              ],
              "Resource": [
                  "*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>And its trust relationship is:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "es.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  </code></pre>
  
  <p>I wonder what else I missed here.</p>
  
  <p>This post <code>AccessDenied for EC2 Instance with attached IAM Role</code> doesn't seem to relate to my issue. </p>