The security token included in the request is invalid on request to dynamoDB from Elastic beanstalk

I have it configured

extended_ec2_policy_document = <<EOF
{
  "Statement": [
      {
          "Action": [
              "dynamodb:PutItem",
              "dynamodb:BatchWriteItem",
              "dynamodb:GetItem",
              "dynamodb:BatchGetItem",
              "dynamodb:Query",
              "dynamodb:UpdateItem",
              "dynamodb:DeleteItem"
          ],
          "Effect": "Allow",
          "Resource": "dynamoDB arn",
          "Sid": "some sid"
      }
  ],
  "Version": "2012-10-17"
}
EOF
}

AWS cli is working on ec2 with this app so i believe there is no problem with keys / credentials

The CLI is very likely using different credentials. In your app, call GetCallerIdentity https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html`

Tried that, and get the same error about security token

SSH to your ElasticBeanstalk instance and export credentials using the CLI. This is the first in the chain and will solve your issue.