S3 Vector: SAM template permission update

[andy-k-improving]

Summary 📝

Restrict overly permissive Resource: '*' in the S3 Vector connector SAM template to least-privilege scoped ARNs.

Changes:

• athena:GetQueryExecution — scoped from * to arn:aws:athena:<region>:<account>:workgroup/*
• S3 Vectors list access (ListIndexes, ListVectors) — scoped from * to account/region level for schema and table discovery
• S3 Vectors data access (GetIndex, QueryVectors, GetVectors) — scoped to a specific vector bucket and all indexes within it
• Added S3VectorBucketName parameter (required) to specify the target vector bucket

All ARNs use CloudFormation pseudo parameters (AWS::Partition, AWS::Region, AWS::AccountId) — no hardcoded values.

Impact:

• Lambda can only read vector data from the specified bucket
• Listing operations remain account-wide (required for metadata discovery)
• Cross-account and cross-region access blocked by default
• No functional change for users querying a single vector bucket

Test plan:

• Deploy connector with S3VectorBucketName set to target bucket
• Verify SHOW SCHEMAS, SHOW TABLES, and SELECT queries still work
• Verify queries against other vector buckets are denied

Permissions

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.