diff --git a/cmd/http-tracer.go b/cmd/http-tracer.go
index bdfcc2d86..004afd046 100644
--- a/cmd/http-tracer.go
+++ b/cmd/http-tracer.go
@@ -83,14 +83,15 @@ func getOpName(name string) (op string) {
 	op = strings.TrimPrefix(name, "github.com/minio/minio/cmd.")
 	op = strings.TrimSuffix(op, "Handler-fm")
 	op = strings.Replace(op, "objectAPIHandlers", "s3", 1)
-	op = strings.Replace(op, "webAPIHandlers", "s3", 1)
+	op = strings.Replace(op, "webAPIHandlers", "webui", 1)
 	op = strings.Replace(op, "adminAPIHandlers", "admin", 1)
 	op = strings.Replace(op, "(*storageRESTServer)", "internal", 1)
 	op = strings.Replace(op, "(*peerRESTServer)", "internal", 1)
 	op = strings.Replace(op, "(*lockRESTServer)", "internal", 1)
-	op = strings.Replace(op, "stsAPIHandlers", "sts", 1)
+	op = strings.Replace(op, "(*stsAPIHandlers)", "sts", 1)
 	op = strings.Replace(op, "LivenessCheckHandler", "healthcheck", 1)
 	op = strings.Replace(op, "ReadinessCheckHandler", "healthcheck", 1)
+	op = strings.Replace(op, "-fm", "", 1)
 	return op
 }
 
diff --git a/cmd/sts-errors.go b/cmd/sts-errors.go
index 20e951efa..63c8e6365 100644
--- a/cmd/sts-errors.go
+++ b/cmd/sts-errors.go
@@ -78,6 +78,7 @@ const (
 	ErrSTSInvalidParameterValue
 	ErrSTSWebIdentityExpiredToken
 	ErrSTSClientGrantsExpiredToken
+	ErrSTSInvalidAccessKey
 	ErrSTSInvalidClientGrantsToken
 	ErrSTSMalformedPolicyDocument
 	ErrSTSNotInitialized
@@ -127,6 +128,11 @@ var stsErrCodes = stsErrorCodeMap{
 		Description:    "The client grants token that was passed could not be validated by MinIO.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrSTSInvalidAccessKey: {
+		Code:           "InvalidClientTokenId",
+		Description:    "The security token included in the request is invalid.",
+		HTTPStatusCode: http.StatusForbidden,
+	},
 	ErrSTSMalformedPolicyDocument: {
 		Code:           "MalformedPolicyDocument",
 		Description:    "The request was rejected because the policy document was malformed.",
diff --git a/cmd/sts-handlers.go b/cmd/sts-handlers.go
index e418cd1db..2d0e73fdf 100644
--- a/cmd/sts-handlers.go
+++ b/cmd/sts-handlers.go
@@ -116,11 +116,17 @@ func checkAssumeRoleAuth(ctx context.Context, r *http.Request) (user auth.Creden
 	case authTypeSigned:
 		s3Err := isReqAuthenticated(ctx, r, globalServerRegion, serviceSTS)
 		if STSErrorCode(s3Err) != ErrSTSNone {
+			if s3Err == ErrInvalidAccessKeyID {
+				return user, ErrSTSInvalidAccessKey
+			}
 			return user, STSErrorCode(s3Err)
 		}
 		var owner bool
 		user, owner, s3Err = getReqAccessKeyV4(r, globalServerRegion, serviceSTS)
 		if STSErrorCode(s3Err) != ErrSTSNone {
+			if s3Err == ErrInvalidAccessKeyID {
+				return user, ErrSTSInvalidAccessKey
+			}
 			return user, STSErrorCode(s3Err)
 		}
 		// Root credentials are not allowed to use STS API