title: STS AssumeRole error: AWS Access Key "does not exist in our records"
body: <p>I'm working on an API Gateway/Lambda-based project. The request flow works as follows:</p>
  
  <ul>
  <li>API Gateway passes request to Authorizer lambda</li>
  <li>Authorizer lambda calls <code>sts.assumeRole()</code> and successfully generates an <code>accessKeyId</code> and <code>secretAccessKey</code></li>
  <li>Key/secret are passed to request handler lambda via authorizer context</li>
  <li>Request handler lambda uses the given <code>accessKeyId/secretAccessKey</code> to attempt to access items from an S3 bucket</li>
  </ul>
  
  <p>Every step of the process is working (confirmed via console log), except for the final one. When I attempt to use the generated credentials, I get the following error message:</p>
  
  <pre><code>   {
        "message": "The AWS Access Key Id you provided does not exist in our records.",
        "code": "InvalidAccessKeyId",
        "region": null,
        "time": "2019-07-19T22:05:05.817Z",
        "requestId": "...",
        "extendedRequestId": "...",
        "statusCode": 403,
        "retryable": false,
        "retryDelay": 68.28400384749038
      }
  </code></pre>
  
  <p>I know this hints strongly that there's something about STS that I don't understand, but I haven't been able to figure out what. (For example, does AWS de-allocate the generated role when the authorizer lambda finishes running?)</p>
  
  <p><strong>Why would AWS be rejecting a freshly-generated pair of credentials, and report this error message?</strong></p>