title: Invalid token while running aws S3 cli command on AWS Lambda function
body: <p>I have a lambda function attached in which i run the command <code>aws ls s3://bucketname.com</code>, which fails with the error:</p>
  
  <pre><code>botocore.exceptions.ClientError: An error occurred (InvalidToken) when calling the ListObjectsV2 operation: The provided token is malformed or otherwise invalid.
  </code></pre>
  
  <p>I've been struggling to identify the problem, which looks like a permissions issue?
  However, the attached IAM role has an inline policy which is essentially allowing everything:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Test0",
              "Effect": "Allow",
              "Action": [
                  "s3:*"
              ],
              "Resource": [
                  "arn:aws:s3:::bucketname.com/*",
                  "arn:aws:s3:::bucketname.com"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>I've already tried specifying the region in the command (<code>aws --region eu-west-3 s3 ls s3://bucketname.com</code>) <a href="https://stackoverflow.com/a/54837250/149872">as suggested in another SO question</a>, but I still get the same error.</p>
  
  <p><strong>edit:</strong> If I add the option <code>--debug</code>, I see:</p>
  
  <pre><code>2019-11-26 11:46:48,292 - MainThread - botocore.endpoint - DEBUG - Making request for OperationModel(name=ListObjectsV2) with params: {'url_path': '/bucketname.com?list-type=2', 'query_string': {'prefix': '', 'delimiter': '/', 'encoding-type': 'url'}, 'method': 'GET', 'headers': {'User-Agent': 'aws-cli/1.16.291 Python/3.7.5 Linux/4.14.138-99.102.amzn2.x86_64 exec-env/AWS_Lambda_python3.7 botocore/1.13.27'}, 'body': b'', 'url': 'https://s3.eu-west-3.amazonaws.com/bucketname.com?list-type=2&amp;prefix=&amp;delimiter=%2F&amp;encoding-type=url', 'context': {'client_region': 'eu-west-3', 'client_config': &lt;botocore.config.Config object at 0x7fc7e6670e10&gt;, 'has_streaming_input': False, 'auth_type': None, 'encoding_type_auto_set': True, 'signing': {'bucket': 'bucketname.com'}}}
  .. removed for conciseness..
  2019-11-26 11:46:48,294 - MainThread - botocore.endpoint - DEBUG - Sending http request: &lt;AWSPreparedRequest stream_output=False, method=GET, url=https://s3.eu-west-3.amazonaws.com/bucketname.com?list-type=2&amp;prefix=&amp;delimiter=%2F&amp;encoding-type=url, headers={'User-Agent': b'aws-cli/1.16.291 Python/3.7.5 Linux/4.14.138-99.102.amzn2.x86_64 exec-env/AWS_Lambda_python3.7 botocore/1.13.27', 'X-Amz-Date': b'20191126T114648Z', 'X-Amz-Security-Token': b'REMOVED', 'X-Amz-Content-SHA256': b'REMOVED', 'Authorization': b'AWS4-HMAC-SHA256 Credential=REMOVED/eu-west-3/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token, Signature=REMOVED'}&gt;
  ..removed for conciseness..
  2019-11-26 11:46:48,312 - MainThread - botocore.parsers - DEBUG - Response body:
  b'&lt;?xml version="1.0" encoding="UTF-8"?&gt;\n&lt;Error&gt;&lt;Code&gt;InvalidToken&lt;/Code&gt;&lt;Message&gt;The provided token is malformed or otherwise invalid.&lt;/Message&gt;...
  </code></pre>
  
  <p>Any ideas of what could be going wrong?</p>