I followed all the steps mentioned in this tutorial:

https://aws.amazon.com/blogs/big-data/ingest-and-analyze-your-data-using-amazon-opensearch-service-with-amazon-opensearch-ingestion/

But getting this error:

ApiError: The “opensearch.aws_sts_role_arn” does not have access to domain test. This role should contain permissions to run describeDomain, and should contain a trust relationship with the Service Principal osis-pipelines.amazonaws.com.

This must be something related to IAM policy. Is there any easy to create required role/ policy? (For e.g. cloudformation template)