Apologies, I should have noted the code being used to call call_ses is the same code as in the original post.
I am looking at modules but rewriting this isn't really an option, it's a legacy system that is failing now due to the AWS signature version change from 3 to 4. I'm just trying to get it to send the Signature V4 header instead of the V3.