Expand description
shared auth/response/request-id plumbing for every Firehose-backed ingestion route Shared Kinesis Data Firehose HTTP Endpoint Delivery plumbing, reused by every Firehose-backed ingestion route (metrics, CloudWatch Logs, and any future signal).
Everything here is signal-agnostic — it only knows about the Firehose transport
(access-key header, ack shape), not what’s inside a record. Firehose’s only credential
channel is the non-standard X-Amz-Firehose-Access-Key header — it cannot send
Authorization: Bearer. So a Firehose route cannot sit under the global Bearer
auth_middleware; it has its own auth step that synthesizes a bearer header from the
Firehose header and reuses the same AuthProvider (constant-time keyring check)
verbatim.