amazon-web-services - 无法为 AWS es 域注册快照存储库

Question

我正在尝试注册快照存储库。我使用了以下角色和策略:

{
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
            "Service": "es.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
    }]
} 

政策如下:

{
    "Version": "2012-10-17",
    "Statement": [{
        "Action": ["s3:ListBucket"],
        "Effect": "Allow",
        "Resource": ["arn:aws:s3:::es-backuptest"]
    }, {
        "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "iam:PassRole"],
        "Effect": "Allow",
        "Resource": ["arn:aws:s3:::es-backuptest/*"]
    }]
}

我正在使用下面的 python 脚本:

from boto.connection import AWSAuthConnection

class ESConnection(AWSAuthConnection):

    def __init__(self, region, **kwargs):
        super(ESConnection, self).__init__(**kwargs)
        self._set_auth_region_name(region)
        self._set_auth_service_name("es")

    def _required_auth_capability(self):
        return ['hmac-v4']

    if __name__ == "__main__":

    client = ESConnection(
            region='ap-south-1',
            host='es.domain.com',
            aws_access_key_id='test_id',
            aws_secret_access_key='test_secret_id', is_secure=False)

    print 'Registering Snapshot Repository'
    resp = client.make_request(method='POST',
            path='/_snapshot/snapshot-backup',
            data='{"type": "s3","settings": { "bucket": "es-backuptest","region": "ap-south-1","role_arn": "arn:aws:iam::arn:aws:iam::arn:aws:iam::rolename"}}')
    body = resp.read()
    print body

完成所有这些后，我正在运行 python 脚本进行注册，但出现以下错误:

{"Message":"不允许跨账号传递角色。"}

任何人都可以让我知道我在这里缺少什么。

Answer 1

bucket配置有误，修改如下

 data='{"type": "s3","settings": { "bucket": "S3-test-bucket","region": "us-east-1","base_path":"es-backuptest/","role_arn": "arn:aws:iam::rolename"}}') 

这解决了问题。