User arnawssts925412301675assumed-roleAWSReservedSSO_AWSPowerUserAccess_6af6acbce53da99cyunhui is not authorized to perform iamPassRole on resource arnawsiam925412301675roleOpenSearchLambdaRole becaus

This error message indicates that the user "arn:aws:sts::925412301675:assumed-role/AWSReservedSSO_AWSPowerUserAccess_6af6acbce53da99c/yunhui" does not have permission to perform the "iam:PassRole" action on the "arn:aws:iam::925412301675:role/OpenSearchLambdaRole" resource.

To resolve this issue, you need to add an identity-based policy that allows the user to perform the "iam:PassRole" action on the specified resource.

Here's an example of an identity-based policy that grants the necessary permission:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowPassRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::925412301675:role/OpenSearchLambdaRole"
    }
  ]
}

You can attach this policy to the user "arn:aws:sts::925412301675:assumed-role/AWSReservedSSO_AWSPowerUserAccess_6af6acbce53da99c/yunhui" using the AWS Management Console, AWS CLI, or AWS SDKs according to your preference and access method