AWS pre-signed URL omitting x-amz-security-token when not used with an STS token

My calls to get a pre-signed URL for a putObject operation on S3 are returning without the x-amz-security-token if I use my default web identity credentials

var s3 = new AWS.S3();
var params = {Bucket: 'myBucket', Key: 'myKey'};
var url = s3.getSignedUrl('getObject', params);
console.log("The URL is", url);

returns

http://ift.tt/1hb5pkQ

However, if I use an Cognito/STS token and set the AWS credentials to that - I do get the security token.

http://ift.tt/1hb5rJe

I've checked the default web role and identity and they have put permissions to the bucket. What am I doing wrong? What should I be checking either in the code or in the AWS configuration to sort out why it's not returning a working s3 signed url?