Getting ClientError: An error occurred (ForbiddenException) when calling the Publish operation: Forbidden?

I am confused how AWS boto3 and access key works.

I have set up an IAM user w/ poweruser and programmatic access. I entered the access key and access secret key into aws configure.

In my python script, I: import boto3 iot = boto3.client('iot-data');

...a little later I have code that does:

    response = iot.publish(
         topic='/sbs/devicedata/flow',
         payload=data
    )

The iot.publish causes the error:

ClientError: An error occurred (ForbiddenException) when calling the Publish operation: The security token included in the request is invalid.

I verify that I have the access key and secret keys in the aws config file that were generated when I created my user account.

Perhaps I am missing how an access key gets associated with the boto3 binding? I guess boto3 gets the key info from the config file. But shouldn't those be valid?

Thank you.