feature: verify the message by AWS SNS signingCertUrl.

[kazaff]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Baseed on suggestion from AWS, any SNS message need to be verifed. So this pull request realize the must-do work.
Now when you handle the request from SNS, you can get the whole payload of message and verify it.

💡 Motivation and Context

As I saied before.

💚 How did you test it?

📝 Checklist

• I reviewed submitted code
• I added tests to verify changes
• I updated reference documentation to reflect the change
• All tests passing
• No breaking changes

🔮 Next steps

[maciejwalkowiak]

@kazaff thank you for a PR. We are discussing and looking into it internally. Can you point me to the suggestion from AWS that you followed?

[kazaff]

@kazaff thank you for a PR. We are discussing and looking into it internally. Can you point me to the suggestion from AWS that you followed?

@maciejwalkowiak Hi, thanks for your reply.

https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html

I think you mean this document?

[maciejwalkowiak]

@kazaff thanks for clarification and your efforts. Unfortunately, we must reject your PR. Lack of verifying message signature is a missing part in AWS SDK v2, and I don't believe we should compensate it in Spring Cloud AWS as it is clearly the SDK level responsibility.

My advice is to do one of these:

• try contributing your solution to AWS SDK v2
• create a separate open source project with SNS verification feature, and Spring Cloud AWS integration (starter, autoconfigure). If there are any needs to make SNS integration on our side more flexible to enable such integration - we can definitely do that.

[kazaff]

@maciejwalkowiak Got it and thank you👍