Does Firehose ensure at-least-once delivery when consuming a kinesis data stream?

I'm using debezium to generate CDC events that I want to get into S3. There are two easy paths forward:

1. Use Debezium Server and push events into Kinesis -> Firehose -> S3.
2. Use MSK and MSK Connect. I'd prefer to go with option 1 due to the simplicity of the approach, but I can't find much information about how Firehose consumes a Kinesis Data Stream. The only docs I can find about this topic indicate that firehose uses LATEST shard iterators.

Does Firehose maintain checkpoints internally and know where to restart? When Firehose has a internal service disruption, would it restart at LATEST or where it left off?

I cannot tolerate event loss from the CDC stream.