I think the question here should more be answered from a marketing than a security perspective.
In general, I would say that Google probably uses a relatively simple API key for usability/accessibility, in order to make it easier for the mass of developers to implement their services (and earn money from that).
Amazon probably has more concerns about the use of their API and uses a different system of public and secret keys. The use of a secret key does add a certain protection and can not directly be considered as security-by-obfuscation (while technically most security is basically a form of obfuscation).
To answer your question in the comment:
I'm actually curious to understand why would anyone want to make public (lucrative) service hard to use. Other than complexity what other gains is there to signature VS using a key?
Two reasons came to my mind about this:
The first one is probably that it gives a sense of security and this can be a reason for companies to choose a harder to implement service above an easy-to-implement service. Because it's considered "more secure". This raises the question if the security features are actually adding an extra layer of security or if they just complicate things unnecessarily.
The second one is probably that it can actually add extra security. When we, for example, use a service that charges money for each request and the only authentication is one key. Then, if the key leaks, anyone can use that API using my key and so I will get charged for it. An example of an extra security layer is IP whitelisting in combination with the key. This mitigated at least the problem that anyone can misuse my key. SSL (HTTPS) adds a layer of encryption to the communication between the server and the client (possibly mitigating man-in-the-middle attacks). Other possible features or measures can be DNSSEC, custom encryption, time-frames, key/credential expiration et cetera, all adding actual security to mitigate different attacks.
For the vendors, it is (as often with security) a constant consideration between usability and security. They will consider things like:
- How far can and should we go, without getting paranoid?
- How far do we need to go to protect the services (data) we offer?
- Is it still acceptable by developers if we go this far?