[Go] AWS SDK v1 End-of-Life and Deprecation Notice

## [Go] AWS SDK v1 End-of-Life and Deprecation Notice

**URGENT**: AWS SDK for Go v1 reached end-of-life on July 31, 2025 and is no longer receiving security updates ([AWS announcement](https://aws.amazon.com/blogs/developer/announcing-end-of-support-for-aws-sdk-for-go-v1-on-july-31-2025/)).

**Status**: All Asherah Go code has been migrated to AWS SDK v2. AWS SDK v1 plugins and backward-compatibility wrappers remain available but are deprecated. Removal is pending.

### Migration Path

#### Use AWS SDK v2 Plugins

**KMS Operations**:
```go
import (
"context"
"github.com/aws/aws-sdk-go-v2/config"
awsv2kms "github.com/godaddy/asherah/go/appencryption/plugins/aws-v2/kms"
)

cfg, err := config.LoadDefaultConfig(context.Background(), config.WithRegion(preferredRegion))
if err != nil {
return nil, err
}

kmsService, err := awsv2kms.NewBuilder(crypto, regionMap).
WithAWSConfig(cfg).
WithPreferredRegion(preferredRegion).
Build()
```

**DynamoDB Metastore**:
```go
import (
"context"
"github.com/aws/aws-sdk-go-v2/config"
awsv2persistence "github.com/godaddy/asherah/go/appencryption/plugins/aws-v2/persistence"
)

cfg, err := config.LoadDefaultConfig(context.Background(), config.WithRegion(region))
if err != nil {
return nil, err
}

metastore, err := awsv2persistence.NewBuilder().
WithAWSConfig(cfg).
WithRegion(region).
WithTableName(tableName).
Build()
```

### Timeline

| Milestone | Status | Description |
|-----------|--------|-------------|
| **AWS SDK v1 EOL** | Complete | AWS ended security support for SDK v1 |
| **Migration PRs** | Complete | Server, samples, integration tests, and deprecation comments merged |
| **Deprecation Implementation** | Complete | All v1 types and functions carry `Deprecated:` comments pointing to v2 equivalents |
| **Removal of v1 Code** | **Pending** | Remove deprecated v1 plugins, backward-compat wrappers, and v1 dependency |

### Completed Work

All migration PRs have been merged:

- **[PR #1488](https://github.com/godaddy/asherah/pull/1488)**: Go server migration from AWS SDK v1 to v2
- **[PR #1489](https://github.com/godaddy/asherah/pull/1489)**: Sample applications migration to AWS SDK v2
- **[PR #1490](https://github.com/godaddy/asherah/pull/1490)**: Integration test utilities migration to AWS SDK v2
- **[PR #1492](https://github.com/godaddy/asherah/pull/1492)**: Updated deprecation comments with EOL context
- **[PR #1512](https://github.com/godaddy/asherah/pull/1512)**: Complete AWS KMS plugin upgrade to v2

### Remaining Work: v1 Removal

The following v1 artifacts are deprecated and should be removed:

- [ ] Remove `plugins/aws-v1/` directory (KMS and DynamoDB v1 plugin implementations)
- [ ] Remove `pkg/kms/aws.go` backward-compatibility wrapper
- [ ] Remove `pkg/persistence/dynamodb.go` backward-compatibility wrapper
- [ ] Migrate or remove `integrationtest/dynamodbtest/dynamodbtest.go` (v1 test utilities; v2 equivalent exists at `dynamodbtest_awsv2.go`)
- [ ] Remove `aws-sdk-go` v1 from `go/appencryption/go.mod` and `integrationtest/go.mod`

### Backward Compatibility

#### What Doesn't Change
- **Encryption Format**: No changes to data encryption or key storage
- **AWS Configuration**: Existing IAM policies and AWS configurations remain valid
- **API Behavior**: Functional behavior of KMS and DynamoDB operations unchanged

#### What Changes
- **Import Paths**: Update imports from `plugins/aws-v1/` or `pkg/` to `plugins/aws-v2/`
- **Configuration Code**: AWS SDK v2 uses different configuration patterns
- **Dependencies**: Applications will depend on AWS SDK v2 instead of v1

### FAQ

#### Q: Can I continue using AWS SDK v1 components?
**A**: Not recommended. AWS SDK v1 reached end-of-life July 31, 2025 and no longer receives security updates. The v1 plugins remain available for now but will be removed in a future release.

#### Q: Will migration break my existing encrypted data?
**A**: No. Encryption format and key storage are unchanged. Existing data remains fully accessible.

#### Q: Do I need to update my AWS IAM policies?
**A**: No. AWS permissions and resource access remain the same.

#### Q: What's the difference between `pkg/` and `plugins/aws-v1/`?
**A**: Both use the EOL AWS SDK v1. The `pkg/` APIs are backward-compatibility wrappers (type aliases) that delegate to `plugins/aws-v1/`. Both are deprecated.

#### Q: When will deprecated components be removed?
**A**: Removal is pending and will be scheduled as part of the next cleanup cycle.

---

**Migration Priority**: HIGH (Security - AWS SDK v1 has been EOL since July 31, 2025)
**Recommended Action**: Migrate to `plugins/aws-v2/` implementations
**Examples**: See PRs #1488, #1489, #1490, #1492, #1512 for complete migration patterns

Start by reviewing plugins/aws-v1/, pkg/kms/aws.go, pkg/persistence/dynamodb.go, and integrationtest/dynamodbtest/dynamodbtest.go, comparing the latter with dynamodbtest_awsv2.go. Check both go/appencryption/go.mod and integrationtest/go.mod for the v1 dependency, then run the relevant Go tests. Done means the deprecated v1 plugins, wrappers, test utility, and dependency references are removed without changing encrypted data or v2 behavior.

Written by the indexing model from the issue text.