use unsigned payload over HTTPS for s3

Author: luigi liu

codegen/aws-sdk-codegen/src/main/kotlin/aws/sdk/kotlin/codegen/customization/s3/ClientConfigIntegration.kt

@@ -66,6 +66,18 @@ class ClientConfigIntegration : KotlinIntegration {
             useSymbolWithNullableBuilder(KotlinTypes.Boolean, "true")
             documentation = "Flag to enable [aws-chunked](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html) content encoding."
         }
+
+        val PayloadSigningEnabled: ConfigProperty = ConfigProperty {
+            name = "payloadSigningEnabled"
+            useSymbolWithNullableBuilder(KotlinTypes.Boolean, "false")
+            documentation = """
+                Flag to control whether request payloads are signed (SHA-256 hash computed) before sending.
+                When `false` (default), payload signing is automatically disabled for HTTPS requests to improve
+                performance, since TLS already provides integrity protection. Payloads are always signed for
+                HTTP (non-TLS) requests regardless of this setting. Set to `true` to force payload signing
+                even over HTTPS.
+            """.trimIndent()
+        }
     }
 
     override fun preprocessModel(model: Model, settings: KotlinSettings): Model {
@@ -91,6 +103,7 @@ class ClientConfigIntegration : KotlinIntegration {
         UseArnRegionProp,
         DisableMrapProp,
         EnableAwsChunked,
+        PayloadSigningEnabled,
     )
 
     override val sectionWriters: List<SectionWriterBinding>

codegen/aws-sdk-codegen/src/main/kotlin/aws/sdk/kotlin/codegen/customization/s3/S3SigningConfig.kt

@@ -40,5 +40,6 @@ class S3SigningConfig : KotlinIntegration {
         writer.putIfAbsent(signingAttrs, "UseDoubleUriEncode", "false")
         writer.putIfAbsent(signingAttrs, "SignedBodyHeader", writer.format("#T.X_AMZ_CONTENT_SHA256", RuntimeTypes.Auth.Signing.AwsSigningCommon.AwsSignedBodyHeader))
         writer.putIfAbsent(signingAttrs, "EnableAwsChunked", "config.enableAwsChunked")
+        writer.putIfAbsent(signingAttrs, "PayloadSigningEnabled", "config.payloadSigningEnabled")
     }
 }

services/s3/common/src/aws/sdk/kotlin/services/s3/express/S3ExpressHttpSigner.kt

@@ -6,12 +6,10 @@ package aws.sdk.kotlin.services.s3.express
 
 import aws.smithy.kotlin.runtime.auth.awscredentials.Credentials
 import aws.smithy.kotlin.runtime.auth.awssigning.AwsSigningAttributes
-import aws.smithy.kotlin.runtime.auth.awssigning.HashSpecification
 import aws.smithy.kotlin.runtime.collections.toMutableAttributes
 import aws.smithy.kotlin.runtime.http.auth.HttpSigner
 import aws.smithy.kotlin.runtime.http.auth.SignHttpRequest
 import aws.smithy.kotlin.runtime.http.request.header
-import aws.smithy.kotlin.runtime.net.Scheme
 
 internal const val S3_EXPRESS_SESSION_TOKEN_HEADER = "X-Amz-S3session-Token"
 private const val SESSION_TOKEN_HEADER = "X-Amz-Security-Token"
@@ -39,17 +37,10 @@ internal class S3ExpressHttpSigner(
         val mutAttrs = signingRequest.signingAttributes.toMutableAttributes()
         mutAttrs[AwsSigningAttributes.OmitSessionToken] = true
 
-        // 3. use unsigned payload over HTTPS when no explicit hash specification is set
-        if (!mutAttrs.contains(AwsSigningAttributes.HashSpecification)) {
-            if (signingRequest.httpRequest.url.scheme == Scheme.HTTPS) {
-                mutAttrs[AwsSigningAttributes.HashSpecification] = HashSpecification.UnsignedPayload
-            }
-        }
-
-        // 4. call main signer
+        // 3. call main signer
         httpSigner.sign(signingRequest.copy(signingAttributes = mutAttrs))
 
-        // 5. remove session token header
+        // 4. remove session token header
         signingRequest.httpRequest.headers.remove(SESSION_TOKEN_HEADER)
     }
 }