feat: add AWS EventBridge destination

[pryzmatical]

Closes #201.

Adds aws_eventbridge as a new destination type, following the existing aws_kinesis/aws_sqs provider pattern. Implements the shape discussed on #201 with @alexbouchardd:

• config.event_bus_name (optional, name or ARN — empty uses the account's default bus) + config.region (required) + config.endpoint (optional, LocalStack/VPC endpoint override)
• credentials.key/secret/session are all optional on the destination itself (not hard-required), so a future credential-less publishing mode can be added later without a breaking config change. Static credentials are still always passed to the AWS SDK explicitly, even when empty, rather than omitted — an empty NewStaticCredentialsProvider fails loudly with an auth error instead of the SDK silently falling back to its default credential chain (env vars, shared config, EC2/ECS/EKS instance role) and authenticating as whatever role the outpost process happens to be running under.
• Source is a fixed, app-level setting (DESTINATIONS_EVENTBRIDGE_SOURCE server config, defaulting to outpost), not a per-destination field, matching how EventBridge rules commonly key off Source to identify the emitting application.
• DetailType is the event's topic; Detail carries metadata+data in the same envelope shape as aws_kinesis's metadata-in-payload mode, since EventBridge has no side channel for metadata the way SQS message attributes do.

Batch/error handling

PutEvents is a batch API even for a single entry, and reports per-entry success/failure in the response body rather than solely via the returned Go error — a call can return err == nil with FailedEntryCount == 1 if that one entry was rejected. Publish() checks both the top-level error and the entry's own ErrorCode before calling a publish successful, rather than trusting a nil top-level error alone.

Error responses (both paths) are sanitized through a shared classifyErrorCode: AWS's own ErrorCode enum values are safe to pass through as-is, but the human-readable message is always authored here, never AWS's own ErrorMessage text, which can embed account IDs and ARNs in permission-denied style errors.

Tests

Unit coverage for Format() (envelope shape, Source/DetailType/EventBusName wiring) and the error-classification functions (including a test that explicitly asserts no AWS-authored message text, ARNs, or account IDs ever leak through) — all passing.

No LocalStack-based Publish() integration test is included. My local environment has no Docker available, so I couldn't write and verify one the way aws_sqs/aws_kinesis do — I'd rather flag that gap explicitly than submit integration test code I can't confirm actually passes. Every other AWS/queue destination's Publish() correctness is likewise only covered by its LocalStack suite rather than unit tests, so this matches existing project convention for the parts that are covered; happy to add the integration test in a follow-up once I can verify it, or if a maintainer would rather add it directly.

Docs

instructions.md + metadata.json for the new provider, a destinations/aws-eventbridge.mdoc page mirroring aws-kinesis.mdoc, nav.json/overview.mdoc/concepts.mdoc listing entries, and the DESTINATIONS_EVENTBRIDGE_SOURCE entry in docs/apis/openapi.yaml's managed config schema (hand-maintained alongside config.go, per #992's precedent).

🤖 Generated with Claude Code

https://claude.ai/code/session_01SNTzCmsH3jiGqgPqi4QMfj

[alexluong]

Sorry for the late review, and thanks for this! The PR is in good shape and I tested it locally without issues. What's left is mostly cleanup:

• key/secret should be required
• OpenAPI is missing the destination schemas (config/credentials, create/update, and aws_eventbridge in the type enums), so the SDKs can't create this type yet
• a LocalStack integration test like the other AWS destinations have (the test compose needs events added to SERVICES)
• a cmd/destinations/awseventbridge helper for trying it locally, like the other destination types
• a few smaller points inline

Happy to take it from here if you prefer, just let me know.

[alexluong]

These should be required, same as aws_kinesis. While they're optional, a destination with no credentials is accepted and every publish fails with a generic "the request to EventBridge failed". Making a required field optional later isn't a breaking change, so the credential-less mode can relax this when it lands.

[alexluong]

Can we name this DESTINATIONS_AWS_EVENTBRIDGE_SOURCE to match DESTINATIONS_AWS_KINESIS_METADATA_IN_PAYLOAD? The OpenAPI entry would change too.

[alexluong]

Destination defaults live in the config defaults in config.go (see AWSKinesis.MetadataInPayload). Can we set Source: "outpost" there, drop this fallback and the "outpost" in the provider's New, and have New return an error when the source is empty? That's how the webhook provider treats its settings.

[alexluong]

Kinesis and SQS put the AWS error message in the attempt response, and I'd do the same here. The attempt is only visible to the tenant who owns this AWS account, so the ARN and account ID in an AccessDenied message are their own. The message is also what tells them which action or resource is missing. Non-AWS errors (missing credentials, DNS, timeouts) all end up as "the request to EventBridge failed", which doesn't tell the user what went wrong.

[alexluong]

When a deployment has no TOPICS configured, events can be published without a topic, and DetailType ends up empty, which AWS rejects. Worth a fallback value here?

[alexluong]

With the default bus this renders as in us-east-1 with no console link. Could it show default in us-east-1 and link to the default bus?

[alexluong]

nit: if FailedEntryCount > 0 but Entries is empty, this falls through to success. AWS shouldn't return that, but treating FailedEntryCount > 0 alone as a failure is safer.