feature/cloudfront/sign: Add SHA-256 support for signed URLs and cookies

[Suto-Michimasa]

Describe the feature

Amazon CloudFront announced support for SHA-256 signed URLs and signed cookies on April 1, 2026.
https://aws.amazon.com/about-aws/whats-new/2026/04/amazon-cloudfront-sha-256-signed-urls

Currently, feature/cloudfront/sign hardcodes SHA-1 in signEncodedPolicy()

aws-sdk-go-v2/feature/cloudfront/sign/policy.go

Lines 202 to 207 in 790446e

	hash := sha1.New()
	if _, err := bytes.NewReader(jsonPolicy).WriteTo(hash); err != nil {
	return nil, fmt.Errorf("failed to calculate signing hash, %s", err.Error())
	}
	sig, err := signer.Sign(randReader, hash.Sum(nil), crypto.SHA1)

The generated signed URLs also do not include the Hash-Algorithm query parameter.

According to the CloudFront documentation, SHA-256 signed URLs require:

1. Hashing the policy with SHA-256 instead of SHA-1
2. Appending &Hash-Algorithm=SHA256 to the signed URL

Use Case

SHA-256 is cryptographically stronger than SHA-1. While CloudFront maintains backward compatibility with SHA-1, adopting SHA-256 aligns with security best practices. Some organizations have compliance requirements that mandate SHA-2 family algorithms.

Proposed Solution

Add an option to URLSigner and CookieSigner to specify the hash algorithm. For example:

// Option function approach
signer := sign.NewURLSigner(keyID, privKey, sign.WithHashAlgorithm(sign.SHA256))

// Or a new constructor
signer := sign.NewURLSignerSHA256(keyID, privKey)

Changes needed:

1. In signEncodedPolicy(): use crypto/sha256 and crypto.SHA256 when SHA-256 is selected
2. In buildSignedURL() / buildSignedCookie(): append Hash-Algorithm=SHA256 parameter
3. Default to SHA-1 for backward compatibility

Other Information

• AWS announcement: https://aws.amazon.com/about-aws/whats-new/2026/04/amazon-cloudfront-sha-256-signed-urls/
• CloudFront docs (canned policy): https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-canned-policy.html
• PR Update CF CookieSigner to use crypto.Signer interface #3325 (open) is updating CookieSigner to use crypto.Signer — this feature could build on that work

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS Go SDK V2 Module Versions Used

github.com/aws/aws-sdk-go-v2/feature/cloudfront/sign v1.9.21

Go version used

go1.26.1 darwin/arm64