aws: track Amazon Inspector findings per namespace in vulnerability latest transform

[kcreddy]

Proposed commit message

aws: track Amazon Inspector findings per namespace in vulnerability latest transform

The Inspector vulnerability latest transform grouped only on
aws.inspector.transform_unique_id, so findings sharing a unique id across
different data_stream namespaces collapsed into a single latest document,
and findings from non-default namespaces could not be compared. Add
data_stream.namespace to the transform's unique key so findings are tracked
per namespace, matching the other CDR vulnerability transforms.

Adding a field to the unique key re-keys every destination document _id.
Since a fleet_transform_version bump reinstalls the transform but keeps the
existing destination index, the re-keyed documents would otherwise coexist
with the old-keyed ones under the vulnerability_latest alias for up to 90
days. Move the destination index to
security_solution-awsinspector.vulnerability_latest-v2 so the re-keyed
documents land in a clean index and the alias moves with it.

Bump fleet_transform_version to 0.4.0 so existing deployments delete and
reinstall the transform on upgrade.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[vera-review-bot]

No issues across the latest commits 3de6edc.

Review summary

Issues found across earlier commits 1a71110 — 1 high

• 🟠 Changing the latest transform's unique_key changes every destination document _id, but the existing destination index is kept on upgrade, so old-keyed documents linger as duplicates. Bump the destination index to -v2 alongside the fleet_transform_version bump. (link) (Unresolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 3de6edc

cc @kcreddy

[elastic-vault-github-plugin-prod]

Package aws - 7.1.1 containing this change is available at https://epr.elastic.co/package/aws/7.1.1/