cloudfront signer

[aajtodd]

Motivation and Context

Implements CloudFront signed URL and signed cookie generation for private content access control (see CloudFront developer guide), addressing #255.

Overview

This PR adds a new aws-sdk-cloudfront-signer crate that provides cryptographic signing capabilities for CloudFront URLs and cookies. CloudFront signed URLs/cookies enable time-limited, policy
-based access control to private CloudFront distributions using RSA-SHA1 or ECDSA-SHA1 signatures.

Key Features

• Signed URLs: Generate URLs with embedded signatures for single-resource access
• Signed Cookies: Generate cookies for multi-resource access without URL modification
• Canned Policies: Simple time-based expiration
• Custom Policies: Advanced access control with activation dates, IP restrictions, and wildcard patterns
• Multiple Key Formats: RSA (PKCS#1/PKCS#8) and ECDSA P-256 (PKCS#8) private keys
• HTTP Ecosystem Integration: Direct conversion to http::Request and url::Url types

API Design

use aws_sdk_cloudfront_signer::{sign_url, SigningRequest, PrivateKey};
use std::time::Duration;

let key = PrivateKey::from_pem(include_bytes!("private_key.pem"))?;

let request = SigningRequest::builder()
    .resource_url("https://d111111abcdef8.cloudfront.net/image.jpg")
    .key_pair_id("APKAEXAMPLE")
    .private_key(key)
    .expires_in(Duration::from_secs(3600))
    .build()?;

let signed_url = sign_url(request)?;

Implementation Details

• Separate crate: Independent of CloudFront SDK for focused functionality
• Builder pattern: Fluent API following AWS SDK Rust conventions
• Type-safe: Compile-time validation where possible, runtime validation in build()
• Error handling: Structured errors with source preservation and descriptive messages
• Performance: Stores parsed url::Url internally to avoid re-parsing

Feature Flags

• rt-tokio: Async file loading with PrivateKey::from_pem_file()
• http-1x: Conversion to http::Request types

Testing

• unit tests for all components
• Integration tests with RSA and ECDSA keys
• SEP test cases for validation
• Integration tests against an actual distribution

Checklist

• For changes to the smithy-rs codegen or runtime crates, I have created a changelog entry Markdown file in the .changelog directory, specifying "client," "server," or both in the applies_to key.
• For changes to the AWS SDK, generated SDK code, or SDK runtime crates, I have created a changelog entry Markdown file in the .changelog directory, specifying "aws-sdk-rust" in the applies_to key.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[github-actions]

A new generated diff is ready to view.

• AWS SDK (ignoring whitespace)
• No codegen difference in the Client Test
• No codegen difference in the Server Test
• No codegen difference in the Server Test Python
• No codegen difference in the Server Test Typescript

A new doc preview is ready to view.

[ysaito1001]

Looks good, as it did already in the design. A separate crate doesn't look bad at all. Might be worth running this change through catapult with dev account if we want to be sure.

[github-actions]

A new generated diff is ready to view.

• AWS SDK (ignoring whitespace)
• No codegen difference in the Client Test
• No codegen difference in the Server Test
• No codegen difference in the Server Test Python
• No codegen difference in the Server Test Typescript

A new doc preview is ready to view.

[github-actions]

A new generated diff is ready to view.

• AWS SDK (ignoring whitespace)
• No codegen difference in the Client Test
• No codegen difference in the Server Test
• No codegen difference in the Server Test Python
• No codegen difference in the Server Test Typescript

A new doc preview is ready to view.

[github-actions]

A new generated diff is ready to view.

• AWS SDK (ignoring whitespace)
• No codegen difference in the Client Test
• No codegen difference in the Server Test
• No codegen difference in the Server Test Python
• No codegen difference in the Server Test Typescript

A new doc preview is ready to view.

[github-actions]

A new generated diff is ready to view.

• AWS SDK (ignoring whitespace)
• No codegen difference in the Client Test
• No codegen difference in the Server Test
• No codegen difference in the Server Test Python
• No codegen difference in the Server Test Typescript

A new doc preview is ready to view.

[landonxjames]

LGTM. Probably still want to wait for Cloudfront feedback and final approval on the SEP before actually merging