Update permission

Author: andy-k-improving

athena-s3vector-connector/athena-s3vector-connector.yaml

@@ -33,6 +33,9 @@ Parameters:
     Description: "Lambda memory in MB (min 128 - 3008 max)."
     Default: 512
     Type: Number
+  S3VectorBucketName:
+    Description: "The name of the S3 vector bucket to query."
+    Type: String
   DisableSpillEncryption:
     Description: "WARNING: If set to 'true' encryption for spilled data is disabled."
     Default: "false"
@@ -61,18 +64,27 @@ Resources:
               Resource: !Sub 'arn:${AWS::Partition}:athena:${AWS::Region}:${AWS::AccountId}:workgroup/*'
           Version: '2012-10-17'
 
-        # S3 Vector read access
+        # S3 Vector list access (account-wide)
         - Statement:
-          - Sid: AllowApplicationVectorAccess
+          - Sid: AllowVectorListAccess
             Effect: Allow
             Action:
-              - s3vectors:GetIndex
               - s3vectors:ListIndexes
-              - s3vectors:QueryVectors
-              - s3vectors:GetVectors
               - s3vectors:ListVectors
             Resource: !Sub 'arn:${AWS::Partition}:s3vectors:${AWS::Region}:${AWS::AccountId}:*'
 
+        # S3 Vector data access (scoped to specific bucket and its indexes)
+        - Statement:
+          - Sid: AllowVectorDataAccess
+            Effect: Allow
+            Action:
+              - s3vectors:GetIndex
+              - s3vectors:QueryVectors
+              - s3vectors:GetVectors
+            Resource:
+              - !Sub 'arn:${AWS::Partition}:s3vectors:${AWS::Region}:${AWS::AccountId}:vector-bucket/${S3VectorBucketName}'
+              - !Sub 'arn:${AWS::Partition}:s3vectors:${AWS::Region}:${AWS::AccountId}:vector-bucket/${S3VectorBucketName}/*'
+
         #S3CrudPolicy allows our connector to spill large responses to S3. You can optionally replace this pre-made policy
         #with one that is more restrictive and can only 'put' but not read,delete, or overwrite files.
         - S3CrudPolicy: