InvalidSignatureException when using temporary client

[jfacorro]

Description

When making a request with a client created through aws_client:make_temporary_client/4 the response is the following error:

{error,{<<"InvalidSignatureException">>,
        <<"The request signature we calculated does not match the signature you provided. Check your AWS Secret"...>>},
       {400,
        [{<<"Server">>,<<"Server">>},
         {<<"Date">>,<<"Thu, 16\nJul 2020 12:30:14 GMT">>},
         {<<"Content-Type">>,<<"application/x-amz-json-1.1">>},
         {<<"Content-Length">>,<<"229">>},
         {<<"Connection">>,<<"keep-alive">>},
         {<<"x-amzn-RequestId">>,
          <<"0771a7ea-7aca-43e2-9b1e-312074724c5a">>}],
        #Ref<0.1229173320.3980918785.234390>}}

Steps to reproduce

$ rebar3 shell
1> application:ensure_all_started(aws).
2> Client = aws_client:make_temporary_client(<<"valid_id">>, <<"valid_secret">>, <<"valid_token">>, <<"eu-west-1">>).
3> aws_ssm:list_commands(Client, #{}).
{error,{<<"InvalidSignatureException">>,
        <<"The request signature we calculated does not match the signature you provided. Check your AWS Secret"...>>},
       {400,
        [{<<"Server">>,<<"Server">>},
         {<<"Date">>,<<"Thu, 16 Jul 2020 14:16:54 GMT">>},
         {<<"Content-Type">>,<<"application/x-amz-json-1.1">>},
         {<<"Content-Length">>,<<"229">>},
         {<<"Connection">>,<<"keep-alive">>},
         {<<"x-amzn-RequestId">>,
          <<"b79951b9-cf8f-4ecf-b613-41b0a9fced0c">>}],
        #Ref<0.1094149039.1313603590.42867>}}

Root cause

The header X-Amz-Security-Token is being added twice (once in aws_{service}:request/4 function and another in aws_request:sign_request/5), but the signature is generated when it is there only once, so it becomes invalid.