How do I use Signature Version 4 in ordinary AWS CLI calls?

Simple AWS CLI commands like aws ec2 describe-images --region $REGION produce the error AWS was not able to validate the provided access credentials when REGION is one of af-south-1, ap-east-1, eu-south-1, or me-south-1.

This StackOverflow question says that newer regions only support Signature Version 4. How do I choose this in my AWS CLI (v. 2.4.15)? This says that that happens automatically, but clearly it does not.

Notes:

• This occurs whether I have this ~/.aws/config file or it is missing:

region = us-east-1
output = json
cli_pager=

• I have no .boto.

• My clock and timezone seem correct.