title: InvalidClientTokenId when using IAM user
body: <p>I'm having trouble implementing <code>GetCallerIdentity</code> with AWS within my application. When I try to generate <em>temporary credentials</em>, the server console returns the error <code>InvalidClientTokenId: The security token included in the request is invalid</code>. </p>
  
  <p>I've been looking at the <a href="https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html" rel="nofollow noreferrer">AWS documentation</a> and I'm wondering if I've set up my IAM user incorrectly. The documentation says; </p>
  
  <p>The temporary security credentials created by GetSessionToken can be used to make API calls to any AWS service with the following exceptions:</p>
  
  <ul>
  <li>You cannot call any IAM APIs unless MFA authentication information is
  included in the request.</li>
  <li>You cannot call any STS API except AssumeRole or GetCallerIdentity.</li>
  </ul>
  
  <p>Does this mean I can't use IAM accounts with the below example? I'm building in meteor js and I'm trying to implement a package called <a href="https://github.com/CulturalMe/meteor-slingshot#s3-with-temporary-aws-credentials-advanced" rel="nofollow noreferrer">SlingShot</a>. The documentation doesn't mention errors like this. </p>
  
  <pre><code>var sts = new AWS.STS();
  
  sts.getSessionToken({
    DurationSeconds: duration
  }, function (error, result) {
    console.log('error', error);
    callback(error, result &amp;&amp; result.Credentials);
  });
  </code></pre>