The API is usually much easier to use than the direct REST calls especially the reasonably new Command Line Interface -- which is much more lightweight, and exceptionally easier to use as a result of the JSON integration, than the original by-product Command Line Tools
It's somewhere inside the documentation, but the following links seem to lead us toward an answer:
1) the high-level description of the "AUTHPARAMS" (as referenced frequently in the API documentation.)
AuthParams
The parameters that are required to authenticate a Conditional request. Contains:
AWSAccessKeyID
SignatureVersion
Timestamp
Signature
Default: None
Required: Conditional
2) a step by step outline of the parameters needed for a REST request:
3) the detailed outline of the method to derive the "signature" for the "AUTHPARAMS"
This is the example in the documentation (I've added new lines to make it easier to read)
https://elasticmapreduce.amazonaws.com?
AWSAccessKeyId=AKIAIOSFODNN7EXAMPLE&
Action=DescribeJobFlows&
SignatureMethod=HmacSHA256&
SignatureVersion=2&
Timestamp=2011-10-03T15%3A19%3A30&
Version=2009-03-31&
Signature=i91nKc4PWAt0JJIdXwz9HxZCJDdiy6cf%2FMj6vPxyYIs%3D