fix(s3vectors): return Grant covering all index ARNs in _internalGrant (#1358)

* fix(s3vectors): return Grant covering all index ARNs in _internalGrant

When granting on an explicit indexIds array, _internalGrant reassigned
indexResult on each loop iteration (keeping only the last index ARN) and
then returned `bucketResult ?? indexResult`, so callers received a Grant
referencing only the bucket - never the index permissions actually granted.
The IAM policy document was always correct (statements are added as a side
effect); only the returned Grant handle was wrong, which breaks dependency
wiring via grant.applyBefore()/assertSuccess().

- Combine per-index grants with Grant.combine instead of overwriting
- Combine the bucket and index grants for the return value
- Add a regression test asserting the returned Grant references every
  specified index ARN, not just the last

* test(s3vectors): assert bucket ARN survives combine + parametrize grantRead/Write/Delete

Address @krokoko's two review suggestions on the returned-Grant regression test:
- Assert the bucket statement survives bucketResult.combine(indexResult), not
  just the index ARNs (a standalone VectorBucketArn resource without /index/).
- Parametrize across grantRead/grantWrite/grantDelete via test.each so all three
  exercise the multi-index combine path; grantDelete is the exact last-index-only
  scenario from the bug title.

Test-only; the fix in vector-bucket.ts is unchanged. All 3 cases fail on the
pre-fix return (bucketResult ?? indexResult) and pass with the combine.

---------

Co-authored-by: Alain Krok <alkrok@amazon.com>

Author: valter-silva-au

src/cdk-lib/s3vectors/vector-bucket.ts

@@ -301,15 +301,18 @@ export abstract class VectorBucketBase extends Resource implements IVectorBucket
           resource: this,
         });
       } else if (Array.isArray(indexIds)) {
+        // Grant per index and combine the results so the returned Grant
+        // references every index ARN, not just the last one in the array.
         for (const indexId of indexIds) {
           const indexArn = `${this.vectorBucketArn}/index/${indexId}`;
 
-          indexResult = iam.Grant.addToPrincipalOrResource({
+          const indexGrant = iam.Grant.addToPrincipalOrResource({
             actions: indexActions,
             grantee: grantee,
             resourceArns: [indexArn],
             resource: this,
           });
+          indexResult = indexResult ? indexResult.combine(indexGrant) : indexGrant;
         }
       } else {
         throw new ValidationError(lit`@aws-cdk/s3vectors:VectorBucket`, 'indexIds must be a string (\'*\') or an array of strings', this);
@@ -320,6 +323,11 @@ export abstract class VectorBucketBase extends Resource implements IVectorBucket
       this.encryptionKey?.grant(grantee, ...keyActions);
     }
 
+    // Combine the bucket and index grants so the returned Grant represents all
+    // permissions granted (bucket + indexes), not only the bucket statement.
+    if (bucketResult && indexResult) {
+      return bucketResult.combine(indexResult);
+    }
     return bucketResult ?? indexResult ?? iam.Grant.drop(grantee, 'No actions to grant');
   }
 }

test/cdk-lib/s3vectors/vector-bucket.test.ts

@@ -623,6 +623,46 @@ describe('VectorBucket', () => {
       });
     });
 
+    // The returned Grant object is used by callers for dependency wiring
+    // (grant.applyBefore(...), grant.assertSuccess(), inspecting statements).
+    // It must represent ALL index ARNs that were granted - not only the last
+    // index in the array - AND the bucket statement, which is the second half
+    // of the fix (bucketResult.combine(indexResult)). grantDelete is the exact
+    // "last index only" scenario from the bug title, so all three grant methods
+    // exercise the multi-index combine path here.
+    test.each([
+      ['grantRead', (g: iam.IGrantable, ids: string[]) => bucket.grantRead(g, ids)],
+      ['grantWrite', (g: iam.IGrantable, ids: string[]) => bucket.grantWrite(g, ids)],
+      ['grantDelete', (g: iam.IGrantable, ids: string[]) => bucket.grantDelete(g, ids)],
+    ] as const)(
+      '%s returns a Grant referencing every index ARN and the bucket ARN, not just the last index',
+      (_name, grantFn) => {
+        const grant = grantFn(role, ['index1', 'index2']);
+
+        const resolved = [
+          ...grant.principalStatements,
+          ...grant.resourceStatements,
+        ].map((statement) => stack.resolve(statement.toStatementJson()).Resource);
+        const resources = JSON.stringify(resolved);
+
+        // Every specified index ARN is present - not just the last one.
+        expect(resources).toContain('/index/index1');
+        expect(resources).toContain('/index/index2');
+
+        // The bucket statement survives the combine. Index ARNs are built from
+        // the bucket ARN (Fn::Join of the VectorBucketArn GetAtt + "/index/..."),
+        // so a plain "VectorBucketArn" match alone would also pass from an index
+        // statement. Assert a standalone bucket resource exists - one that
+        // references VectorBucketArn WITHOUT the "/index/" suffix.
+        expect(resources).toContain('VectorBucketArn');
+        const bucketOnly = resolved.some((resource) => {
+          const asString = JSON.stringify(resource);
+          return asString.includes('VectorBucketArn') && !asString.includes('/index/');
+        });
+        expect(bucketOnly).toBe(true);
+      },
+    );
+
     test('grantWrite grants write permissions', () => {
       bucket.grantWrite(role);