Repository: rusoto/rusoto (language: rust)

Issue:
AWS DynamoDB error "The security token included in the request is invalid." in Rusoto 0.41.0
Since upgrading to Rusoto 0.41.0, trying to use DynamoDB results in an error:

```
{"__type":"com.amazon.coral.service#UnrecognizedClientException","message":"The security token included in the request is invalid."}
```

Rolling back to version 0.40.0 and leaving everything else the same (the rest of the code is the same, the AWS roles are the same, etc.) and the error goes away and the code works as expected.

Unfortunately I'm not familiar enough with the Rusoto codebase to hazard a guess where the issue may be. But I had brief glance through the `rusoto_credential` library and it appears mostly unchanged between 0.40.0 and 0.41.0; so if I were to guess I would say it appears to be an issue in the DynamoDB client that is, somehow, not providing the required security token.

Some more details which may be helpful:

1. The code in question runs on an EC2 box, and the DynamoDB permissions are controlled via an IAM role assigned to an instance profile.

2. The code uses the `DefaultCredentialsProvider`.


Discussion / hints:
#1508 [changed the `Deserialize` implementation for `AwsCredentials`](https://github.com/rusoto/rusoto/commit/3969784e75bb687ca975c1d118d8634eddc71ad6), wondering if that's related.
It could be if the `AwsCredentials` struct is used deserialise the response from the instance metadata. 

According to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials the response will have a field called `Token` rather than `SessionToken`.

So if it was used for that, it would mean the session token would be missing when a DynamoDB call is made?
Yep. I'm testing now, but this is almost certainly a regression that I missed.

I tried an unholy mix of serde attributes to get both to work, but couldn't quite get it. We should add an appropriate deserialization test case (even if we can't reasonably test pulling credentials from instance metadata) as well.
`rusoto_ec2::Ec2::describe_regions` also fails with a similar error, and succeeds in 0.40.0.
I am starting work on a PR for this issue.

Fix patch:
diff --git a/rusoto/credential/src/lib.rs b/rusoto/credential/src/lib.rs
index 08480aa88bf..6fc8e5537d9 100644
--- a/rusoto/credential/src/lib.rs
+++ b/rusoto/credential/src/lib.rs
@@ -58,7 +58,7 @@ pub struct AwsCredentials {
     key: String,
     #[serde(rename = "SecretAccessKey")]
     secret: String,
-    #[serde(rename = "SessionToken")]
+    #[serde(rename = "SessionToken", alias = "Token")]
     token: Option<String>,
     #[serde(rename = "Expiration")]
     expires_at: Option<DateTime<Utc>>,
@@ -615,6 +615,7 @@ mod tests {
             credentials.aws_secret_access_key(),
             "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
         );
+        assert!(credentials.token().is_some());
 
         assert_eq!(
             credentials.expires_at().expect(""),


Test patch: