Thanks for clarifying that the pod annotations work. I must have made a mistake in the podTemplate specification.
The second problem is not related to IAM policies. I can verify that the elasticsearch Pod has access to the S3 bucket via the EC2 instance profile by execing into the container and running aws CLI.
However when elasticsearch tries to access the bucket via the Snapshot API it fails with aforementioned error message.