Unable to call AppSync GraphQL api from Lambda: TypeError: Cannot read property 'match' of null

I am trying to call my AWS AppSync graphQL API from Lambda, but I'm stuck at an error that I can't solve, so I'd like to ask your help to figure out what I'm doing wrong.

The credentials seems correct and the query should be correct (see below).

The lambda function is deployed using the Serverless framework and I can invoke it with sls invoke --function <my_function_name>.

I have been following this article

The error I'm getting is:

{
"errorType": "Runtime.UnhandledPromiseRejection",
"errorMessage": "TypeError: Cannot read property 'match' of null",
"trace": [
    "Runtime.UnhandledPromiseRejection: TypeError: Cannot read property 'match' of null",
    "    at process.<anonymous> (/var/runtime/index.js:35:15)",
    "    at process.emit (events.js:310:20)",
    "    at process.EventEmitter.emit (domain.js:482:12)",
    "    at processPromiseRejections (internal/process/promises.js:209:33)",
    "    at processTicksAndRejections (internal/process/task_queues.js:98:32)"
]
}

Error --------------------------------------------------

Error: Invoked function failed
  at AwsInvoke.log (/usr/local/lib/node_modules/serverless/lib/plugins/aws/invoke/index.js:101:31)
  at AwsInvoke.tryCatcher (/usr/local/lib/node_modules/serverless/node_modules/bluebird/js/release/util.js:16:23)
  at Promise._settlePromiseFromHandler (/usr/local/lib/node_modules/serverless/node_modules/bluebird/js/release/promise.js:517:31)
  at Promise._settlePromise (/usr/local/lib/node_modules/serverless/node_modules/bluebird/js/release/promise.js:574:18)
  at Promise._settlePromise0 (/usr/local/lib/node_modules/serverless/node_modules/bluebird/js/release/promise.js:619:10)
  at Promise._settlePromises (/usr/local/lib/node_modules/serverless/node_modules/bluebird/js/release/promise.js:699:18)
  at _drainQueueStep (/usr/local/lib/node_modules/serverless/node_modules/bluebird/js/release/async.js:138:12)
  at _drainQueue (/usr/local/lib/node_modules/serverless/node_modules/bluebird/js/release/async.js:131:9)
  at Async._drainQueues (/usr/local/lib/node_modules/serverless/node_modules/bluebird/js/release/async.js:147:5)
  at Immediate.Async.drainQueues [as _onImmediate] (/usr/local/lib/node_modules/serverless/node_modules/bluebird/js/release/async.js:17:14)
  at runCallback (timers.js:705:18)
  at tryOnImmediate (timers.js:676:5)
  at processImmediate (timers.js:658:5)
  at process.topLevelDomainCallback (domain.js:126:23)

Here is my Lambda function in full:

'use strict'

const AWS = require('aws-sdk');
const gql = require('graphql-tag');
const AWSAppSyncClient = require('aws-appsync').default;
require('isomorphic-fetch');
require('es6-promise').polyfill();

module.exports.pushNotificationHandler = async (event, context, callback) => {

    const appsyncClient = new AWSAppSyncClient({
        url: process.env.GRAPHQL_API_ID,
        region: process.env.AWS_REGION,
        auth: {
            type: 'AWS_IAM',
            credentials: AWS.config.credentials
        },
        disableOffline: true
    },
        {
            defaultOptions: {
                query: {
                    fetchPolicy: 'network-only',
                    errorPolicy: 'all',
                },
            },
        }
    );

    const client = await appsyncClient.hydrated();

    try {

        const result = await client.query({
            query: gql`
                query GetUser {
                    getUser(id: "<A_VALID_USER_ID") {
                        firstname
                    }
                }
            `,
            variables: {}
        });

        console.log(JSON.stringify(result));

        return result;

    } catch (error) {
        console.log(JSON.stringify(error));
        return error;
    }

    callback(null, event);

};

Credentials

I have checked the credentials by simply logging and checked in CloudWatch. There is both an access key and a session token, so I would assume my credentials are correct.

Query

The query I have checked by executing it from the AppSync console. It should work.

IAM Permissions

The permissions are set in the Serverless configuration file, but is the same as:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "appsync:GraphQL"
            ],
            "Resource": [
                "arn:aws:appsync:<REGION>:<ACCOUNTID>:apis/<APIID>/*"
            ]
        }
    ]
}

What am I doing wrong?