### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

AWS has a feature which allows you to [filter incoming lambda invocations using rules](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html). Without this feature I need to filter inside the lambda code itself which will incur more compute and cost in AWS. In the spirit of having as few diffs between localstack and AWS this is highly desireable for my pipeline.

(And fwiw, my pipeline is DynamoDB -> DynamoDB Stream -> Lambda (Python) -> Opensearch)

The current behavior is that create/update-event-source-mapping does parse (and validate) this option, but it isn't honored against incoming events at runtime.

### 🧑‍💻 Implementation

Implement with the same logic as AWS with support for all the operators in the linked article above.

### Anything else?

_No response_
return _client
@pytest.fixture(scope="class")
def boto3_session():
    if os.environ.get("TEST_TARGET", "") == "AWS_CLOUD":
        return boto3.Session()
    return boto3.Session(
        
        aws_access_key_id=get_aws_account_id(),
        aws_secret_access_key="__test_key__",
    )
@pytest.fixture(scope="class")
def aws_http_client_factory(boto3_session):
    """
    Returns a factory for creating new ``SigningHttpClient`` instances using a configurable botocore request signer.
    The default signer is a SigV4QueryAuth. The credentials are extracted from the ``boto3_sessions`` fixture that
    transparently uses your global profile when TEST_TARGET=AWS_CLOUD, or test credentials when running against
    LocalStack.
    Example invocations
        client = aws_signing_http_client_factory("sqs")
        client.get("http://localhost:4566/000000000000/my-queue")
    or
        client = aws_signing_http_client_factory("dynamodb", signer_factory=SigV4Auth)
        client.post("...")
    """
    def factory(