Pinpoint APIs are failing at runtime with a cors issue

[Amplifiyer]

Describe the bug
Pinpoint's update endpoint and API call is failing with the following error

// Console error
Access to fetch at 'https://pinpoint.us-west-2.amazonaws.com/v1/apps/__obfuscated__/endpoints/__obfuscated__' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

// Response hearders
content-length: 2456
content-type: application/json
date: Sat, 25 Jan 2020 01:02:08 GMT
status: 403
via: 1.1 e90b27f8a13d44c35911b9b6b13e0d9e.cloudfront.net (CloudFront)
x-amz-apigw-id: G1P-qGgXvHcFi_A=
x-amz-cf-id: 56kWeFE4uhA-MxTt9u3gd8fSqvJQQkZe95Vyvc3i8AUNyelf7jiu5Q==
x-amz-cf-pop: HIO50-C2
x-amzn-errortype: InvalidSignatureException
x-amzn-requestid: 25cc7e42-5206-4710-a5bb-ffeff6cabf2b
x-cache: Error from cloudfront

The Options request works fine but then on PUT request for both of the above APIs it fails

SDK version number
@aws-sdk/client-pinpoint@1.0.0-alpha.10

Is the issue in the browser/Node.js?
Browser

Details of the browser/Node.js version
Browsers:
Chrome: 79.0.3945.130
Safari: 13.0.4

To Reproduce (observed behavior)
Make a call to either UpdateEndpoint or PutEvents API

Expected behavior
There should be no error.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

[trivikr]

I was able to successfully call Pinpoint's listTemplates API

Commit: https://github.com/trivikr/aws-sdk-js-tests/commit/60030ce40220dd86bb80c1d4b28fe61be96984a9

Steps to test browser: https://github.com/trivikr/aws-sdk-js-tests/tree/pinpoint-cors-issue#browser

Screenshot:

Testing other UpdateEndpoint/PutEvents API next

[trivikr]

I'm able to reproduce CORS issue with createApp API call.
Commit: https://github.com/trivikr/aws-sdk-js-tests/commit/fa2fc3b9f54e5d8134f0f252919f0338fefbae08

Code:

const v3Client = new Pinpoint({
  region: REGION,
  credentials: fromCognitoIdentityPool({
    client: new CognitoIdentityClient({
      region: REGION,
      credentials: () => Promise.resolve({})
    }),
    identityPoolId: IDENTITY_POOL_ID
  })
});
const response = await v3Client.createApp({
  CreateApplicationRequest: {
    Name: "TestApplication792"
  }
});

Error:

Access to fetch at 'https://pinpoint.us-west-2.amazonaws.com/v1/apps' from origin 'null' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Screenshot:

[trivikr]

Probably related to cors trait in smithy models
Documentation https://awslabs.github.io/smithy/spec/http.html#cors-trait

This trait is not present in existing Pinpoint smithy model https://github.com/aws/aws-sdk-js-v3/blob/smithy-codegen/models/pinpoint.2016-12-01.json

[Amplifiyer]

Here is the test repo to reproduce Pinpoint:UpdateEndPoint API call issue https://github.com/Amplifiyer/aws-sdk-js-tests

[trivikr]

I'm able to repro Pinpoint CORS issue with following dependencies:

    "@aws-sdk/client-cognito-identity": "^1.0.0-alpha.16",
    "@aws-sdk/client-pinpoint": "^1.0.0-alpha.14",
    "@aws-sdk/credential-provider-cognito-identity": "^1.0.0-alpha.14",

Code: https://github.com/trivikr/aws-sdk-js-tests/blob/eb47e3a2bbabd7faf28fc7214c6edcc9d2d3a85b/src/index.js
Branch: https://github.com/trivikr/aws-sdk-js-tests/tree/pinpoint-cors-issue

Verified that x-amz-user-agent user agent is sent as per #826

Request Headers JSON:

{
  "credentials": "include",
  "headers": {
    "accept": "*/*",
    "accept-language": "en-US,en;q=0.9",
    "authorization": "<AUTH>",
    "content-type": "application/json",
    "sec-fetch-mode": "cors",
    "sec-fetch-site": "cross-site",
    "x-amz-content-sha256": "UNSIGNED-PAYLOAD",
    "x-amz-date": "20200206T210638Z",
    "x-amz-security-token": "<SECURITY-TOKEN>",
    "x-amz-user-agent": "<USER-AGENT>"
  },
  "referrerPolicy": "no-referrer-when-downgrade",
  "body": "[object Object]",
  "method": "POST",
  "mode": "cors"
}

[Amplifiyer]

It's only working when the request payload is empty. As soon as payload is non-empty, the V3 call doesn't work anymore. the request payload for the http request seen in the dev tools is [object Object] which possibly causes issues with the signature.

Also the failing call has the header
x-amz-content-sha256: UNSIGNED-PAYLOAD

while the working call (without request obj) and V2 has
x-amz-content-sha256: 5cf92xxxxxxxxxxxxxxxxxx96ad8f43xxxxxxxx2d