S3 Vectors API: document TagResource, UntagResource and ListTagsForResource

S3-Vector-Bucket-Security.md

@@ -72,7 +72,7 @@ s3v.put_vector_bucket_policy(vectorBucketName="team-a", policy=json.dumps(policy
 With this policy, identity `reader` can list the bucket, its indexes and their vectors, and query them; `PutVectors` and `DeleteIndex` still get `AccessDeniedException`.
 
 * **Principal**: the caller's account, as `{"AWS": "reader"}` or a list, or `"*"` for every authenticated identity. An identity's account is its name when it has no `account` in the S3 configuration, and its `account.id` otherwise. A statement that names an identity with an `account` by its name does not match it, not even a `Deny`.
-* **Action**: `s3vectors:` followed by the operation name, e.g. `s3vectors:QueryVectors`, or `s3vectors:*`. Each operation of the [[S3 Vectors API]] checks the action of the same name.
+* **Action**: `s3vectors:` followed by the operation name, e.g. `s3vectors:QueryVectors`, or `s3vectors:*`. Each operation of the [[S3 Vectors API]] checks the action of the same name. A `CreateVectorBucket` or `CreateIndex` with `tags` also needs `s3vectors:TagResource`.
 * **Resource**: the bucket ARN, an index ARN, or a wildcard such as `arn:aws:s3vectors:us-east-1:000000000000:bucket/team-a/index/*`. ARNs always use region `us-east-1` and account `000000000000`.
 * **Deny wins**: a matching `Deny` overrides any `Allow`, the owner's access and the identity's own actions. Only an identity with the `Admin` action in the `admin` account is exempt.
 

S3-Vectors-API.md

@@ -12,7 +12,7 @@ Requests go to the S3 port, signed with SigV4 for the service `s3vectors`. Use a
 | `PutVectorBucketPolicy`, `GetVectorBucketPolicy`, `DeleteVectorBucketPolicy` | yes |
 | `CreateIndex`, `GetIndex`, `ListIndexes`, `DeleteIndex` | yes |
 | `PutVectors`, `GetVectors`, `ListVectors`, `DeleteVectors`, `QueryVectors` | yes |
-| `TagResource`, `UntagResource`, `ListTagsForResource` | planned ([#12332](https://github.com/seaweedfs/seaweedfs/issues/12332)); today they get HTTP 404 |
+| `TagResource`, `UntagResource`, `ListTagsForResource` | yes, see [Tags](#tags) |
 
 Every bucket and index can be addressed by name or by ARN. ARNs always use region `us-east-1` and account `000000000000`, e.g. `arn:aws:s3vectors:us-east-1:000000000000:bucket/media/index/movies`; an ARN with another partition, region or account, or a name that disagrees with the ARN, is rejected with `ValidationException`. The region a request is signed for is not checked.
 
@@ -39,6 +39,21 @@ s3v.create_index(
 * **`nonFilterableMetadataKeys`**: those keys are stored and returned, but a filter that names one is rejected with `metadata key "description" is not filterable`.
 * Deleting an index removes its vectors. An index created again under the same name starts empty and may have a different dimension or metric.
 
+## Tags
+
+```python
+s3v.tag_resource(resourceArn=bucket_arn, tags={"team": "search", "env": "dev"})
+s3v.untag_resource(resourceArn=bucket_arn, tagKeys=["env"])
+s3v.list_tags_for_resource(resourceArn=bucket_arn)["tags"]  # {"team": "search"}
+```
+
+* `resourceArn` is a vector bucket or index ARN. An index has its own tags and does not inherit the bucket's.
+* `CreateVectorBucket` and `CreateIndex` accept `tags` too.
+* A resource can carry at most 50 tags, counting the ones it already has. A `TagResource` that would exceed that is rejected with `ValidationException`.
+* Keys are 1 to 128 characters and values up to 256, made of letters, digits, spaces and `_ . : / = + - @`.
+* `TagResource` overwrites the value of a key that is already set. `UntagResource` ignores keys that are not set.
+* A missing bucket or index gets `NotFoundException`.
+
 ## Distance metrics
 
 The metric is fixed when the index is created and used by every query; it is returned by `GetIndex` and in each `QueryVectors` response as `distanceMetric`. The metric name is not case-sensitive.