lambda_es_backup_passrole.tf

resource "aws_iam_policy" "snapshot_passrole_policy" {
  name        = "snapshot_passrole_policy"
  path        = "/"
  description = "Allow role to assume the snapshot role to create OpenSearch snapshots"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "${aws_iam_role.snapshot_role.arn}"
    }
  ]
}
EOF
}