fix(s3vectors): update invalid IAM condition key format (#1279)

Author: krokoko

src/cdk-lib/s3vectors/vector-bucket.ts

@@ -672,21 +672,19 @@ export class VectorBucket extends VectorBucketBase {
       actions: ['kms:Decrypt'],
       resources: ['*'],
       conditions: {
-        ArnLike: {
+        'ArnLike': {
           'aws:SourceArn': stack.formatArn({
             service: 's3vectors',
             resource: 'bucket',
             resourceName: '*',
             arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
           }),
         },
-        StringEquals: {
+        'StringEquals': {
           'aws:SourceAccount': stack.account,
         },
-        ForAnyValue: {
-          StringEquals: {
-            'kms:EncryptionContextKeys': ['aws:s3vectors:arn', 'aws:s3vectors:resource-id'],
-          },
+        'ForAnyValue:StringEquals': {
+          'kms:EncryptionContextKeys': ['aws:s3vectors:arn', 'aws:s3vectors:resource-id'],
         },
       },
     }));

src/cdk-lib/s3vectors/vector-index.ts

@@ -454,21 +454,19 @@ export class VectorIndex extends VectorIndexBase {
       actions: ['kms:Decrypt'],
       resources: ['*'],
       conditions: {
-        ArnLike: {
+        'ArnLike': {
           'aws:SourceArn': stack.formatArn({
             service: 's3vectors',
             resource: 'bucket',
             resourceName: '*',
             arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
           }),
         },
-        StringEquals: {
+        'StringEquals': {
           'aws:SourceAccount': stack.account,
         },
-        ForAnyValue: {
-          StringEquals: {
-            'kms:EncryptionContextKeys': ['aws:s3vectors:arn', 'aws:s3vectors:resource-id'],
-          },
+        'ForAnyValue:StringEquals': {
+          'kms:EncryptionContextKeys': ['aws:s3vectors:arn', 'aws:s3vectors:resource-id'],
         },
       },
     }));

test/cdk-lib/s3vectors/vector-bucket.test.ts

@@ -188,12 +188,15 @@ describe('VectorBucket', () => {
               },
               Action: 'kms:Decrypt',
               Condition: Match.objectLike({
-                ArnLike: {
+                'ArnLike': {
                   'aws:SourceArn': Match.anyValue(),
                 },
-                StringEquals: {
+                'StringEquals': {
                   'aws:SourceAccount': '123456789012',
                 },
+                'ForAnyValue:StringEquals': {
+                  'kms:EncryptionContextKeys': ['aws:s3vectors:arn', 'aws:s3vectors:resource-id'],
+                },
               }),
             }),
           ]),

test/cdk-lib/s3vectors/vector-index.test.ts

@@ -268,12 +268,15 @@ describe('VectorIndex', () => {
               },
               Action: 'kms:Decrypt',
               Condition: Match.objectLike({
-                ArnLike: {
+                'ArnLike': {
                   'aws:SourceArn': Match.anyValue(),
                 },
-                StringEquals: {
+                'StringEquals': {
                   'aws:SourceAccount': '123456789012',
                 },
+                'ForAnyValue:StringEquals': {
+                  'kms:EncryptionContextKeys': ['aws:s3vectors:arn', 'aws:s3vectors:resource-id'],
+                },
               }),
             }),
           ]),