clock skew on client gives misleading error

[RichardBradley]

I was running control-tower in a VM which had a clock that was sufficiently wrong that AWS API calls were failing.

Example aws command on this machine:

$ aws sts get-caller-identity

An error occurred (SignatureDoesNotMatch) when calling the GetCallerIdentity operation: Signature expired: 20191
029T154623Z is now earlier than 20191029T163344Z (20191029T164844Z - 15 min.)

I got the following unhelpful error out of control-tower:

$ control-tower deploy --iaas AWS ci.example.com --domain ci.example.com --github-auth-client-secret xxx--github-auth-client-id xxx
error ensuring config bucket exists before deploy: [error determining if bucket [] exists: [InvalidParameter: 1
validation error(s) found.
- minimum field size of 1, HeadBucketInput.Bucket.
]]

After I fixed the clock, everything started working again, but it took me quite a while to work out what was going on because of the strange error. If the control-tower tool had passed through the underlying "Signature expired" error, I would have been able to fix this a lot more quickly.