Confusion over security tokens during make deploy #25

Am I right in my view that the keys needed for a make deploy to complete need to be a user with full access to lambda? I can't seem to get past the following error during the make deploy -

TracingConfig: { Mode: null } }
The security token included in the request is invalid.
=> Retrying
{ [UnrecognizedClientException: The security token included in the request is invalid.]
message: 'The security token included in the request is invalid.',
code: 'UnrecognizedClientException',
time: Wed Jan 03 2018 17:08:09 GMT+0000 (GMT),
requestId: 'abf21363-f0a8-11e7-a226-4b1e45b4187b',
statusCode: 403,
retryable: false,
retryDelay: 40.62163548078388 }
Makefile:38: recipe for target 'deploy' failed
make: *** [deploy] Error 1

I have tried various combinations of .aws entries, exported commandline variables and values within Makefile with no joy.