MissingCredentialsError even though they’re defined

[burritoz]

I'm using the s3snssqs input plugin to ingest logs from an S3 bucket but keep getting MissingCredentialsError even though it's defined. Here's my config:

input {

  s3snssqs {
    queue => "https://sqs.us-west-1.amazonaws.com/X/X"
    region => "us-west-1"
    s3_options_by_bucket => [
      { bucket_name => "s3://X/data"
        credentials => {
          access_key_id => "$ACCESS_KEY_ID"
          secret_access_key => "$SECRET_ACCESS_KEY"
        }
      }
    ]
  }

}

Here's the log from the failed start up:

Jun 10 23:56:38 foo-dev2 logstash[1580686]:   Plugin: <LogStash::Inputs::S3SNSSQS consumer_threads=>2, s3_options_by_bucket=>[{"bucket_name"=>"s3://X/data", "credentials"=>{"access_key_id"=>"X", "secret_access_key"=>"X"}}], id=>"9e196928e1502882e8fa0a0644587ddbed6f72d3d526b349766bff16b66f8e75", region=>"us-west-1", queue=>"https://sqs.us-west-1.amazonaws.com/X/X", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_2dee998a-be49-4dcf-aaa6-2fab593a58d5", enable_metric=>true, charset=>"UTF-8">, threads=>1, role_session_name=>"logstash", s3_role_session_name=>"logstash", delete_on_success=>false, include_object_properties=>[:last_modified, :content_type, :metadata], from_sns=>true, sqs_skip_delete=>false, sqs_delete_on_failure=>true, visibility_timeout=>120, max_processing_time=>8000, temporary_directory=>"/tmp/logstash">
Jun 10 23:56:38 foo-dev2 logstash[1580686]:   Error: unable to sign request without credentials set
Jun 10 23:56:38 foo-dev2 logstash[1580686]:   Exception: Aws::Errors::MissingCredentialsError

What am I doing wrong or what am I missing? Other than defining the access_key_id and secret_access_key that have been configured for that bucket, I don't know what else to do.

Thanks!