amazon web services - Not able to register Snapshot repository for AWS es domain -

i trying register snapshot repository. have used below role , policy:

{     "version": "2012-10-17",     "statement": [{         "sid": "",         "effect": "allow",         "principal": {             "service": "es.amazonaws.com"         },         "action": "sts:assumerole"     }] }  

and policy below:

{     "version": "2012-10-17",     "statement": [{         "action": ["s3:listbucket"],         "effect": "allow",         "resource": ["arn:aws:s3:::es-backuptest"]     }, {         "action": ["s3:getobject", "s3:putobject", "s3:deleteobject", "iam:passrole"],         "effect": "allow",         "resource": ["arn:aws:s3:::es-backuptest/*"]     }] } 

and using below python script:

from boto.connection import awsauthconnection  class esconnection(awsauthconnection):      def __init__(self, region, **kwargs):         super(esconnection, self).__init__(**kwargs)         self._set_auth_region_name(region)         self._set_auth_service_name("es")      def _required_auth_capability(self):         return ['hmac-v4']      if __name__ == "__main__":      client = esconnection(             region='ap-south-1',             host='es.domain.com',             aws_access_key_id='test_id',             aws_secret_access_key='test_secret_id', is_secure=false)      print 'registering snapshot repository'     resp = client.make_request(method='post',             path='/_snapshot/snapshot-backup',             data='{"type": "s3","settings": { "bucket": "es-backuptest","region": "ap-south-1","role_arn": "arn:aws:iam::arn:aws:iam::arn:aws:iam::rolename"}}')     body = resp.read()     print body 

after having in place running python script register, getting below error:

{"message":"cross-account pass role not allowed."}

could please let me know missing here.