feat: Add AWS SigV4 authentication support for OpenSearch and OpenSearch Serverless

[MgeeeeK]

Summary

This PR adds support for authenticating to Amazon OpenSearch Service and Amazon OpenSearch Serverless (AOSS) using AWS SigV4 signing with IAM credentials.

Changes

• New: OpensearchAwsAuthConfigurator implementing SPI interfaces for AWS authentication
• Dependencies: Added AWS SDK dependencies (auth, regions, sts, http-auth-aws) and aws-request-signing-apache-interceptor
• Enhancement: Updated RequestBuilder to handle AOSS requirement (no explicit document IDs)
• Registration: Registered AWS auth configurator in META-INF service loader files

Features

The implementation supports multiple credential sources via AWS SDK's DefaultCredentialsProvider chain:

• IAM Roles for Service Accounts (IRSA) in Kubernetes/EKS
• Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
• EC2 instance profiles
• AWS profiles

Configuration

New connector configuration properties:

• aws.auth.region: AWS region for SigV4 signing (e.g., us-west-2) - Required
• aws.auth.service.name: Service name for SigV4 signing - es for OpenSearch Service or aoss for OpenSearch Serverless - Required

Example Configuration

{
  "connection.url": "https://search-domain.us-west-2.es.amazonaws.com",
  "aws.auth.region": "us-west-2",
  "aws.auth.service.name": "es"
}

Testing

Tested with:

• Amazon OpenSearch Service (managed ES)
• Amazon OpenSearch Serverless (AOSS)
• IRSA authentication in EKS

Notes

• AOSS requires documents to be indexed without explicit IDs, which is handled automatically when aws.auth.service.name=aoss
• The implementation uses the standard AWS SDK credential provider chain, making it compatible with various deployment environments

[danielOfir1]

@willyborankin It's worth reviewing this PR as well, as it implements usage of DefaultCredentialsProvider, which will allow deploying this connector as AWS MSK Connect without the need to provide credentials.

Thanks for the work you're putting into this

[willyborankin]

@willyborankin It's worth reviewing this PR as well, as it implements usage of DefaultCredentialsProvider, which will allow deploying this connector as AWS MSK Connect without the need to provide credentials.

Thanks for the work you're putting into this

I already added this functionality in the new version.