diff --git a/CHANGES.md b/CHANGES.md
index 8ce57419b..0050ce7b9 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,3 +1,9 @@
+## Changes in 1.1.2 (in development)
+
+### Fixes
+
+* Fixed issue where geotiff access from a protected s3 bucket was denied (#863)
+
 ## Changes in 1.1.1
 
 * Bundled new build of [xcube-viewer 1.1.0.1](https://github.com/dcs4cop/xcube-viewer/releases/tag/v1.1.0)
diff --git a/xcube/core/store/fs/impl/dataset.py b/xcube/core/store/fs/impl/dataset.py
index df8d5b1a6..7c6da4808 100644
--- a/xcube/core/store/fs/impl/dataset.py
+++ b/xcube/core/store/fs/impl/dataset.py
@@ -28,6 +28,7 @@
 import s3fs
 import xarray as xr
 import zarr
+from rasterio.session import AWSSession
 
 from xcube.core.zarrstore import LoggingZarrStore
 # Note, we need the following reference to register the
@@ -376,13 +377,16 @@ def open_data(self,
     @classmethod
     def create_env_session(cls, fs):
         if isinstance(fs, s3fs.S3FileSystem):
-            return rasterio.env.Env(aws_secret_access_key=fs.token,
-                                    aws_access_key_id=fs.key,
-                                    aws_session_token=fs.token,
-                                    region_name=fs.client_kwargs.get(
-                                        'region_name',
-                                        'eu-central-1'
-                                    ),
+            aws_session = AWSSession(
+                aws_secret_access_key=fs.secret,
+                aws_access_key_id=fs.key,
+                aws_session_token=fs.token,
+                region_name=fs.client_kwargs.get(
+                    'region_name',
+                    'eu-central-1'
+                ),
+            )
+            return rasterio.env.Env(session=aws_session,
                                     aws_no_sign_request=bool(fs.anon)
                                     )
         else:
diff --git a/xcube/version.py b/xcube/version.py
index cf10b8a2d..7b1935745 100644
--- a/xcube/version.py
+++ b/xcube/version.py
@@ -19,4 +19,4 @@
 # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 # DEALINGS IN THE SOFTWARE.
 
-version = '1.1.1'
+version = '1.1.2.dev0'