my bad, I’d used a random string for aws:region in the config (to ensure no accidental integration with live AWS) turns out this causes all sorts of problems, and using fake credentials is good enough to ensure that any stray requests to live AWS never go through