update elasticsearch IAM to allow S3 snapshots