chore(tests): replace localstack with moto for AWS integration tests

[thomasqueirozb]

Summary

LocalStack 2026.03.0 introduced a mandatory auth token requirement. The grace period for existing users expired on 2026-04-06, after which all CI runs using the free localstack/localstack image started failing with authentication errors (see #24988, which had already pinned to a specific digest as a temporary workaround).

This PR replaces LocalStack with motoserver/moto — a fully open-source, no-auth-required AWS mock — across the AWS integration test infrastructure.

Changes

• tests/integration/aws/config/compose.yaml: Replace mock-localstack (LocalStack image) with mock-aws (motoserver/moto). Remove the SERVICES= env var (moto needs no service selection).
• tests/integration/aws/config/test.yaml: Update all endpoint env vars from http://mock-localstack:4566 to http://mock-aws:5000. Rename the matrix key from localstack_version to moto_version. Remove ELASTICSEARCH_ADDRESS (no longer needed).
• src/sinks/aws_kinesis/firehose/integration_tests.rs: Rewrite to use an S3 delivery destination instead of Elasticsearch. Moto's Firehose implementation delivers records to its internal S3 backend for S3/ExtendedS3 destinations; the Elasticsearch destination is present in moto but ignores record data. The test now creates an S3 bucket, points Firehose at it, sends records, then reads them back via the S3 API.
• Cargo.toml: Remove the unused aws-sdk-elasticsearch dependency (no source files reference it after the Firehose test rewrite). Update the aws-kinesis-firehose-integration-tests feature to depend on sinks-aws_s3 instead.

Limitations / Known Issues

CloudWatch Metrics tests will still fail

aws-sdk-cloudwatch ≥ 1.100.0 switched from the legacy AWS Query Protocol to smithy-rpc-v2 CBOR, sending PutMetricData requests to:

POST /service/GraniteServiceVersion20100801/operation/PutMetricData
Content-Type: application/cbor

Moto's CloudWatch Flask app only registers a route for / (the old query protocol). The CBOR path returns 404. Notably, put_metric_data is marked as implemented in moto's IMPLEMENTATION_COVERAGE.md — the operation logic exists, only the CBOR transport layer is missing.

Possible fixes (not done here, low priority):

• Pin aws-sdk-cloudwatch to =1.99.0 (last version before CBOR; compatible with all current smithy runtime versions in Cargo.lock)
• Build a custom moto Docker image that adds a CBOR route handler decoding requests with cbor2 and forwarding to the existing backend
• Add a CBOR-to-query sidecar proxy in compose.yaml

Vector configuration

N/A — test infrastructure change only.

How did you test this PR?

Ran the AWS integration tests locally with cargo vdev int start aws && cargo vdev int test aws. Firehose and Kinesis Streams tests pass. CloudWatch Metrics tests fail due to the CBOR limitation described above.

Change Type

• Bug fix
• New feature
• Dependencies
• Non-functional (chore, refactoring, docs)
• Performance

Is this a breaking change?

• Yes
• No

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

References

• Related: chore(dev): pin localstack image to SHA256 digest #24988