Yes, but that is supposed to happen - and happens - 'under the hood'.

Basically, I'm trying to access the cloudwatch service, with an IAM user account set up to switch to a given role, from an external (non-AwS) machine.