From dbde7c3ebe01cf416d435338a0b343782bbadcf2 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Mon, 2 Nov 2026 11:18:39 -0800 Subject: [PATCH] S3 Vectors API: document TagResource, UntagResource and ListTagsForResource --- S3-Vector-Bucket-Security.md | 2 +- S3-Vectors-API.md | 17 ++++++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/S3-Vector-Bucket-Security.md b/S3-Vector-Bucket-Security.md index c5820a0..8dfa78f 100644 --- a/S3-Vector-Bucket-Security.md +++ b/S3-Vector-Bucket-Security.md @@ -72,7 +72,7 @@ s3v.put_vector_bucket_policy(vectorBucketName="team-a", policy=json.dumps(policy With this policy, identity `reader` can list the bucket, its indexes and their vectors, and query them; `PutVectors` and `DeleteIndex` still get `AccessDeniedException`. * **Principal**: the caller's account, as `{"AWS": "reader"}` or a list, or `"*"` for every authenticated identity. An identity's account is its name when it has no `account` in the S3 configuration, and its `account.id` otherwise. A statement that names an identity with an `account` by its name does not match it, not even a `Deny`. -* **Action**: `s3vectors:` followed by the operation name, e.g. `s3vectors:QueryVectors`, or `s3vectors:*`. Each operation of the [[S3 Vectors API]] checks the action of the same name. +* **Action**: `s3vectors:` followed by the operation name, e.g. `s3vectors:QueryVectors`, or `s3vectors:*`. Each operation of the [[S3 Vectors API]] checks the action of the same name. A `CreateVectorBucket` or `CreateIndex` with `tags` also needs `s3vectors:TagResource`. * **Resource**: the bucket ARN, an index ARN, or a wildcard such as `arn:aws:s3vectors:us-east-1:000000000000:bucket/team-a/index/*`. ARNs always use region `us-east-1` and account `000000000000`. * **Deny wins**: a matching `Deny` overrides any `Allow`, the owner's access and the identity's own actions. Only an identity with the `Admin` action in the `admin` account is exempt. diff --git a/S3-Vectors-API.md b/S3-Vectors-API.md index 03a01d2..f7bbe18 100644 --- a/S3-Vectors-API.md +++ b/S3-Vectors-API.md @@ -12,7 +12,7 @@ Requests go to the S3 port, signed with SigV4 for the service `s3vectors`. Use a | `PutVectorBucketPolicy`, `GetVectorBucketPolicy`, `DeleteVectorBucketPolicy` | yes | | `CreateIndex`, `GetIndex`, `ListIndexes`, `DeleteIndex` | yes | | `PutVectors`, `GetVectors`, `ListVectors`, `DeleteVectors`, `QueryVectors` | yes | -| `TagResource`, `UntagResource`, `ListTagsForResource` | planned ([#12332](https://github.com/seaweedfs/seaweedfs/issues/12332)); today they get HTTP 404 | +| `TagResource`, `UntagResource`, `ListTagsForResource` | yes, see [Tags](#tags) | Every bucket and index can be addressed by name or by ARN. ARNs always use region `us-east-1` and account `000000000000`, e.g. `arn:aws:s3vectors:us-east-1:000000000000:bucket/media/index/movies`; an ARN with another partition, region or account, or a name that disagrees with the ARN, is rejected with `ValidationException`. The region a request is signed for is not checked. @@ -39,6 +39,21 @@ s3v.create_index( * **`nonFilterableMetadataKeys`**: those keys are stored and returned, but a filter that names one is rejected with `metadata key "description" is not filterable`. * Deleting an index removes its vectors. An index created again under the same name starts empty and may have a different dimension or metric. +## Tags + +```python +s3v.tag_resource(resourceArn=bucket_arn, tags={"team": "search", "env": "dev"}) +s3v.untag_resource(resourceArn=bucket_arn, tagKeys=["env"]) +s3v.list_tags_for_resource(resourceArn=bucket_arn)["tags"] # {"team": "search"} +``` + +* `resourceArn` is a vector bucket or index ARN. An index has its own tags and does not inherit the bucket's. +* `CreateVectorBucket` and `CreateIndex` accept `tags` too. +* A resource can carry at most 50 tags, counting the ones it already has. A `TagResource` that would exceed that is rejected with `ValidationException`. +* Keys are 1 to 128 characters and values up to 256, made of letters, digits, spaces and `_ . : / = + - @`. +* `TagResource` overwrites the value of a key that is already set. `UntagResource` ignores keys that are not set. +* A missing bucket or index gets `NotFoundException`. + ## Distance metrics The metric is fixed when the index is created and used by every query; it is returned by `GetIndex` and in each `QueryVectors` response as `distanceMetric`. The metric name is not case-sensitive.