title: Boto3 invalid AccessToken while accessing S3 bucket
body: <p>I'm trying to access an S3 bucket using Boto3 client with assumed role temporary credentials, and I'm getting an InvalidToken error in the process. </p>
  
  <p>"The provided token is malformed or otherwise invalid"</p>
  
  <p>The S3 bucket is protected with a bucket policy that forces clients to assume a specific role before accessing the bucket.
  The role is assumed using sts client and assume_role operation.</p>
  
  <pre class="lang-py prettyprint-override"><code>import boto3
  import uuid
  
  sts = boto3.client('sts',
                    aws_access_key_id=AWS_ACCESS_KEY,
                    aws_secret_access_key=AWS_SECRET_KEY)
  
  assumed_role_object = sts.assume_role(RoleArn=ROLE_ARN, RoleSessionName=uuid.uuid1().__str__())
  token = assumed_role_object.get("Credentials").get("SessionToken")
  
  session = boto3.Session(aws_access_key_id=AWS_ACCESS_KEY,
                         aws_secret_access_key=AWS_SECRET_KEY,
                         aws_session_token=token,
                         region_name="us-east-1")
  
  s3 = session.client("s3")
  s3.list_objects(Bucket='my_bucket')
  </code></pre>
  
  <p>The list_objects operation gives the following error:</p>
  
  <pre><code>An error occurred (InvalidToken) when calling the ListObjects operation: The provided token is malformed or otherwise invalid.
  Traceback (most recent call last):
    File "/usr/local/lib/python3.4/site-packages/botocore/client.py", line 357, in _api_call
      return self._make_api_call(operation_name, kwargs)
    File "/usr/local/lib/python3.4/site-packages/botocore/client.py", line 661, in _make_api_call
      raise error_class(parsed_response, operation_name)
  botocore.exceptions.ClientError: An error occurred (InvalidToken) when calling the ListObjects operation: The provided token is malformed or otherwise invalid.
  </code></pre>
  
  <p>The code is executed on jupyter notebook executing on EMR cluster.</p>
  
  <p>(In code example above access kyes, role name and bucket name have been replaced with placeholders)</p>