Fully analyzing all four would make this answer too long, but let's compare the AWS and AliPay schemes.
Alipay HTTP signatures
To me this looks very similar to the Signed JWT / JSON Web Signature (JWS) scheme (wikipedia, official spec in RFC 7515). So the entire contents of the JSON body will be protected by the signature. But that's not the entire message. The full HTTP message will include headers and be something like (I'm inventing this)
POST /api/v3/payment/paycancel HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept-Encoding: gzip, deflate, br
Now, with Alipay's signature scheme, only the JSON body is protected, not the HTTP headers. Could an attacker do damage by intercepting your request and modifying the HTTP headers? Maybe.
AWS HTTP signatures
The AWS page you link to says:
To sign a request, you first calculate a hash (digest) of the request. Then you use the hash value, some other information from the request, and your secret access key to calculate another hash known as the signature. Then you add the signature to the request in one of the following ways:
- Using the HTTP Authorization header.
- Adding a query string value to the request. Because the signature is part of the URL in this case, this type of URL is called a presigned URL.
While that page doesn't give a whole lot of technical detail, it sounds like they are trying to sign over the entire HTTP request (including headers) and not just the JSON body.
Wouldn't it be great if HTTP signatures were standardized?
It's been tried. Many times.
In 1999 RFC2660 defined the Secure HyperText Transfer Protocol (S-HTTP), which carries HTTP messages inside Cryptographic Message Syntax (CMS) containers -- the same trick that S/MIME uses to encrypt and sign email. For whatever reason, this never caught on.
More recently, I've seen a couple of attempts at the IETF to sign HTTP requests and responses using headers, similar to what AWS does above:
TL;DR: signing HTTP messages sounds obvious, and it is if you only care about signing the payload of responses and POST requests -- do what Alipay has done and use JWS. Signing the entire HTTP message, including the requested URL and other headers is a lot tricker and standards bodies have been trying for over 20 years to come up with an HTTP signing mechanism that is both secure and flexible.