The Amazon's HMAC schemes includes the hash of the canonical request in the string to sign in order to create the signature, and the canonical request in turn includes the host. What is the security implication of not including the host in this scheme?
In general, you use an HMAC to ensure that a value isn't changed (ie: it doesn't lose integrity). So including the URL in the HMAC means that Amazon doesn't want to allow it to be changed once the HMAC is created.
In this case, including the URL ensures that a request targeted for one URL but somehow sent to another can be detected because the recipient's recalculation of the HMAC will use the actual URL, not the original URL, and the HMACs won't match.
This check will be in addition to whatever security is provided by encrypted communications (eg: SSL).