Authenticate to self-designed Elasticache Redis with IAM

I followed this guide to setup the role/policies/user/group https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/auth-iam.html and used the following code to generate a token. Then connected to the cluster via redis-cli and used the auth "user" "very-long-string" to authenticate. The error i get is

Error: Server closed the connection

Tried setting REDISCLI_AUTH env and tried again. The error i got was

(error) ERR Protocol version is not an integer or out of range

My question is - did anyone successfully tried using IAM to auth to self-designed elasticache for Redis and could offer some tips or gotchas?

package main

import (
	"context"
	"flag"
	"fmt"
	"log"
	"net/http"
	"os"
	"os/signal"

	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/smithy-go/aws-http-auth/credentials"
	v4 "github.com/aws/smithy-go/aws-http-auth/sigv4"
)

var (
	userId    = flag.String("user_id", "", "user id")
	cacheName = flag.String("cache_name", "", "cache name")
	region    = flag.String("region", "us-east-1", "region")
	service   = flag.String("service", "elasticache", "service")
	// algorithm = flag.String("algorithm", "AWS4-HMAC-SHA256", "algorithm")
	profile = flag.String("profile", "default", "AWS profile")
)

func main() {
	flag.Parse()

	if *userId == "" || *cacheName == "" || *region == "" || *profile == "" {
		log.Fatalf("user_id and cache_name and region and profile are required")
	}

	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
	defer cancel()

	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(*region), config.WithSharedConfigProfile(*profile))
	if err != nil {
		log.Fatalf("failed to load config: %v", err)
	}

	creds, err := cfg.Credentials.Retrieve(ctx)
	if err != nil {
		log.Fatalf("failed to retrieve credentials: %v", err)
	}

	endpoint := fmt.Sprintf("https://%s.%s.amazonaws.com", "elasticache", *region)
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, http.NoBody)
	if err != nil {
		log.Fatalf("failed to create request: %v", err)
	}

	in := &v4.SignRequestInput{
		Request: req,
		Service: *service,
		Region:  *region,
		Credentials: credentials.Credentials{
			AccessKeyID:     creds.AccessKeyID,
			SecretAccessKey: creds.SecretAccessKey,
			SessionToken:    creds.SessionToken,
		},
	}

	signer := v4.New()
	if err := signer.SignRequest(in); err != nil {
		log.Fatalf("failed to sign request: %v", err)
	}

	token := in.Request.Header.Get("X-Amz-Security-Token")

	fmt.Printf("Auth to redis with\nauth %q %q\n", *userId, token)
}