Credentials & IAM

Connect to your account, with least-privilege permissions.

dynavec uses the standard boto3 credential chain, so exported env vars just work. You can also pass keys explicitly or assume a cross-account role.

from dynavec import Dynavec, AWSCredentials

# explicit keys / profile / cross-account role
creds = AWSCredentials(
    access_key_id="AKIA...",
    secret_access_key="...",
    region="us-east-1",
    # profile_name="prod",
    # assume_role_arn="arn:aws:iam::OTHER_ACCOUNT:role/dynavec",
)
db = Dynavec(cfg, credentials=creds)

Step-by-step: create the IAM user & keys

1. AWS Console → IAM → Users → Create user. Name it dynavec (programmatic access only — no console sign-in needed).
2. On the permissions step choose Attach policies directly, then Create inline policy and open the JSON tab.
3. Paste the policy below, replacing REGION and ACCOUNT_ID with your region and 12-digit account id. Name it dynavec-access and create it.
4. Open the user → Security credentials → Create access key → Application running outside AWS. Copy the access key id and secret (shown once).
5. Put them in a .env file (below), then run any example.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DynavecS3Vectors",
      "Effect": "Allow",
      "Action": [
        "s3vectors:CreateVectorBucket", "s3vectors:GetVectorBucket",
        "s3vectors:ListVectorBuckets", "s3vectors:DeleteVectorBucket",
        "s3vectors:CreateIndex", "s3vectors:GetIndex",
        "s3vectors:ListIndexes", "s3vectors:DeleteIndex",
        "s3vectors:PutVectors", "s3vectors:GetVectors",
        "s3vectors:ListVectors", "s3vectors:QueryVectors", "s3vectors:DeleteVectors"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DynavecDynamoDB",
      "Effect": "Allow",
      "Action": [
        "dynamodb:CreateTable", "dynamodb:DescribeTable", "dynamodb:DeleteTable",
        "dynamodb:BatchWriteItem", "dynamodb:BatchGetItem",
        "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:UpdateItem",
        "dynamodb:DeleteItem", "dynamodb:Query"
      ],
      "Resource": [
        "arn:aws:dynamodb:REGION:ACCOUNT_ID:table/dynavec_*",
        "arn:aws:dynamodb:REGION:ACCOUNT_ID:table/dynavec_*/index/*"
      ]
    }
  ]
}

Your .env

# .env  (keep this file private — never commit it)
AWS_ACCESS_KEY_ID=AKIA...your-key-id...
AWS_SECRET_ACCESS_KEY=...your-secret...
AWS_REGION=ap-south-1

OPENAI_API_KEY=sk-...        # or GOOGLE_API_KEY / COHERE_API_KEY

Load it before running — set -a && . ./.env && set +a — or use python-dotenv. dynavec then picks up the credentials automatically.

Least-privilege IAM policy

The client needs S3 Vectors (buckets, indexes, vectors) and DynamoDB (table + item ops). A ready policy lives at docs/iam-policy.json.