如何解决错误“"Message":"User: anonymous is not authorized to perform: iam:PassRole on resource"

Question

我正在尝试为我在 AWS 上的 elasticsearch 注册一个快照。我的目标是在 s3 存储桶上创建 elasticsearch 域的快照。以下是我正在使用的命令：

curl -XPUT https://vpc-xxxxxxx.ap-southeast-2.es.amazonaws.com/_snapshot/es-snapshot -d '
{
"type": "s3",
"settings": {
  "bucket": "$MY_BUCKET",
  "region": "ap-southeast-2",
  "role_arn": "arn:aws:iam::xxxx:role/es-snapshot-role"
}
}'

但是我得到了这个错误：

{"Message":"User: anonymous is not authorized to perform: iam:PassRole on resource: arn:aws:iam::xxxx:role/es-snapshot-role"}

这似乎是一个角色权限问题。我已将角色策略配置为：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "es:*",
                "s3:*",
                "iam:PassRole",
                "es:ESHttpPut"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

其信任关系为：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "es.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

不知道我还错过了什么。

这个postAccessDenied for EC2 Instance with attached IAM Role似乎与我的问题无关。

Answer 1

正在注册手动快照存储库

You must register a snapshot repository with Amazon Elasticsearch Service before you can take manual index snapshots. This one-time operation requires that you sign your AWS request with credentials that are allowed to access TheSnapshotRole, as described in Manual Snapshot Prerequisites.

You can't use curl to perform this operation, because it doesn't support AWS request signing. Instead, use the sample Python client, Postman, or some other method to send a signed request to register the snapshot repository. The request takes the following form:

PUT elasticsearch-domain-endpoint/_snapshot/my-snapshot-repo
{
  "type": "s3",
  "settings": {
    "bucket": "s3-bucket-name",
    "region": "region",
    "role_arn": "arn:aws:iam::123456789012:role/TheSnapshotRole"
  }
}

AWS 文档参考：Working with Amazon Elasticsearch Service Index Snapshots

Answer 2

向您的 IAM 用户添加 iam:PassRole 权限并尝试命令，

如何解决错误“"Message":"User: anonymous is not authorized to perform: iam:PassRole on resource"

How to solve the error ""Message":"User: anonymous is not authorized to perform: iam:PassRole on resource"

amazon-web-services

amazon-iam

aws-elasticsearch