feat: Add AWS SigV4 authentication support for OpenSearch and OpenSearch Serverless

[MgeeeeK]

Summary

This PR adds support for authenticating to Amazon OpenSearch Service and Amazon OpenSearch Serverless (AOSS) using AWS SigV4 signing with IAM credentials.

Changes

• New: OpensearchAwsAuthConfigurator implementing SPI interfaces for AWS authentication
• Dependencies: Added AWS SDK dependencies (auth, regions, sts, http-auth-aws) and aws-request-signing-apache-interceptor
• Enhancement: Updated RequestBuilder to handle AOSS requirement (no explicit document IDs)
• Registration: Registered AWS auth configurator in META-INF service loader files

Features

The implementation supports multiple credential sources via AWS SDK's DefaultCredentialsProvider chain:

• IAM Roles for Service Accounts (IRSA) in Kubernetes/EKS
• Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
• EC2 instance profiles
• AWS profiles

Configuration

New connector configuration properties:

• aws.auth.region: AWS region for SigV4 signing (e.g., us-west-2) - Required
• aws.auth.service.name: Service name for SigV4 signing - es for OpenSearch Service or aoss for OpenSearch Serverless - Required

Example Configuration

{
  "connection.url": "https://search-domain.us-west-2.es.amazonaws.com",
  "aws.auth.region": "us-west-2",
  "aws.auth.service.name": "es"
}

Testing

Tested with:

• Amazon OpenSearch Service (managed ES)
• Amazon OpenSearch Serverless (AOSS)
• IRSA authentication in EKS

Notes

• AOSS requires documents to be indexed without explicit IDs, which is handled automatically when aws.auth.service.name=aoss
• The implementation uses the standard AWS SDK credential provider chain, making it compatible with various deployment environments