AWS cli high security documentation change
Summary
Removed vector data retrieval capability, updated permission requirements, and added pagination support
Security assessment
The change explicitly removes the ability to retrieve vector data through this operation, which reduces data exposure. The permission requirements were updated to reflect that s3vectors:GetVectors is no longer required for vector data retrieval (since it's no longer available), tightening access controls. This directly addresses potential over-exposure of sensitive vector data.
Diff
diff --git a/cli/latest/reference/s3vectors/query-vectors.md b/cli/latest/reference/s3vectors/query-vectors.md index e051365a1..e16eb3ad6 100644 --- a//cli/latest/reference/s3vectors/query-vectors.md +++ b//cli/latest/reference/s3vectors/query-vectors.md @@ -15 +15 @@ - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) » @@ -59 +59 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -Performs an approximate nearest neighbor search query in a vector index using a query vector. By default, it returns the keys of approximate nearest neighbors. You can optionally include the computed distance (between the query vector and each vector in the response), the vector data, and metadata of each vector in the response. +Performs an approximate nearest neighbor search query in a vector index using a query vector. By default, it returns the keys of approximate nearest neighbors. You can optionally include the computed distance (between the query vector and each vector in the response) and metadata of each vector in the response. @@ -67,2 +67,2 @@ You must have the `s3vectors:QueryVectors` permission to use this operation. Add - * With only `s3vectors:QueryVectors` permission, you can retrieve vector keys of approximate nearest neighbors and computed distances between these vectors. This permission is sufficient only when you don’t set any metadata filters and don’t request vector data or metadata (by keeping the `returnMetadata` parameter set to `false` or not specified). - * If you specify a metadata filter or set `returnMetadata` to true, you must have both `s3vectors:QueryVectors` and `s3vectors:GetVectors` permissions. The request fails with a `403 Forbidden error` if you request metadata filtering, vector data, or metadata without the `s3vectors:GetVectors` permission. + * With only `s3vectors:QueryVectors` permission, you can retrieve vector keys of approximate nearest neighbors and computed distances between these vectors. This permission is sufficient only when you don’t set any metadata filters and don’t request metadata (by keeping the `returnMetadata` parameter set to `false` or not specified). + * If you specify a metadata filter or set `returnMetadata` to true, you must have both `s3vectors:QueryVectors` and `s3vectors:GetVectors` permissions. The request fails with a `403 Forbidden error` if you request metadata filtering or metadata without the `s3vectors:GetVectors` permission. @@ -75,0 +76,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3vect +`query-vectors` is a paginated operation. Multiple API calls may be issued in order to retrieve the entire data set of results. You can disable pagination by providing the `--no-paginate` argument. When using `--output text` and the `--query` argument on a paginated response, the `--query` argument must extract data from the results of the following query expressions: `vectors` + @@ -87,0 +90,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3vect + [--starting-token <value>] + [--max-items <value>] @@ -200,0 +205,12 @@ JSON Syntax: +`--starting-token` (string) + +> A token to specify where to start paginating. This is the `NextToken` from a previously truncated response. +> +> For usage examples, see [Pagination](https://docs.aws.amazon.com/cli/latest/userguide/pagination.html) in the _AWS Command Line Interface User Guide_ . + +`--max-items` (integer) + +> The total number of items to return in the command’s output. If the total number of items available is more than the value specified, a `NextToken` is provided in the command’s output. To resume pagination, provide the `NextToken` value in the `starting-token` argument of a subsequent command. **Do not** use the `NextToken` response element directly outside of the AWS CLI. +> +> For usage examples, see [Pagination](https://docs.aws.amazon.com/cli/latest/userguide/pagination.html) in the _AWS Command Line Interface User Guide_ . + @@ -351,0 +368,11 @@ distanceMetric -> (string) +nextToken -> (string) + +> Pagination token to be used in the subsequent page request. The field is empty if no further pagination is required. +> +> Constraints: +> +> * min: `1` +> * max: `4096` +> + + @@ -362 +389 @@ distanceMetric -> (string) - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) »