diff --git a/apis/sts/src/main/java/org/jclouds/aws/util/AWSUtils.java b/apis/sts/src/main/java/org/jclouds/aws/util/AWSUtils.java
index a93f8454a9..235e90fc02 100644
--- a/apis/sts/src/main/java/org/jclouds/aws/util/AWSUtils.java
+++ b/apis/sts/src/main/java/org/jclouds/aws/util/AWSUtils.java
@@ -19,6 +19,7 @@ package org.jclouds.aws.util;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static org.jclouds.aws.reference.AWSConstants.PROPERTY_HEADER_TAG;
+import static org.jclouds.http.HttpUtils.closeClientButKeepContentStream;
 
 import java.util.Collection;
 import java.util.Map;
@@ -82,7 +83,8 @@ public class AWSUtils {
    }
 
    public AWSError parseAWSErrorFromContent(HttpRequest request, HttpResponse response) {
-      if (response.getPayload() == null)
+      byte[] actualPayload = response.getPayload() != null ? closeClientButKeepContentStream(response) : null;
+      if (actualPayload == null || actualPayload.length == 0)
          return null;
       if ("text/plain".equals(response.getPayload().getContentMetadata().getContentType()))
          return null;
diff --git a/apis/sts/src/test/java/org/jclouds/aws/util/AWSUtilsTest.java b/apis/sts/src/test/java/org/jclouds/aws/util/AWSUtilsTest.java
index 33014d45ee..821fa5c3d3 100644
--- a/apis/sts/src/test/java/org/jclouds/aws/util/AWSUtilsTest.java
+++ b/apis/sts/src/test/java/org/jclouds/aws/util/AWSUtilsTest.java
@@ -17,6 +17,7 @@
 package org.jclouds.aws.util;
 import static javax.ws.rs.core.MediaType.TEXT_PLAIN;
 import static javax.ws.rs.core.Response.Status.BAD_REQUEST;
+import static javax.ws.rs.core.Response.Status.NOT_FOUND;
 import static org.easymock.EasyMock.createMock;
 import static org.easymock.EasyMock.expect;
 import static org.easymock.EasyMock.replay;
@@ -26,12 +27,17 @@ import static org.testng.Assert.assertNull;
 import java.io.IOException;
 import java.io.InputStream;
 
+import javax.inject.Provider;
+
 import org.jclouds.aws.domain.AWSError;
 import org.jclouds.aws.filters.FormSignerV2Test;
 import org.jclouds.domain.Credentials;
 import org.jclouds.http.HttpCommand;
 import org.jclouds.http.HttpRequest;
 import org.jclouds.http.HttpResponse;
+import org.jclouds.http.functions.ParseSax;
+import org.jclouds.io.payloads.StringPayload;
+import org.jclouds.rest.RequestSigner;
 import org.testng.annotations.AfterTest;
 import org.testng.annotations.BeforeTest;
 import org.testng.annotations.Test;
@@ -88,6 +94,29 @@ public class AWSUtilsTest {
       assertNull(utils.parseAWSErrorFromContent(command.getCurrentRequest(), response));
    }
 
+   /**
+    * Do not attempt to parse empty payload.
+    */
+   @Test
+   public void testNoExceptionEmptyPayload() {
+      RequestSigner requestSigner = createMock(RequestSigner.class);
+      ParseSax.Factory factory = createMock(ParseSax.Factory.class);
+      Provider provider = createMock(Provider.class);
+      // these all will throw UnexpectedInvocationEx if touched
+      replay(requestSigner, factory, provider);
+
+      AWSUtils riggedUtil = new AWSUtils(
+          "ignore",
+          requestSigner,
+          factory,
+          provider
+      );
+
+      HttpResponse response = HttpResponse.builder().statusCode(NOT_FOUND.getStatusCode()).payload(new StringPayload("")).build();
+      response.getPayload().getContentMetadata().setContentType("application/unknown");
+      assertNull(riggedUtil.parseAWSErrorFromContent(command.getCurrentRequest(), response));
+   }
+
    @Test
    public void testParseAWSErrorFromContentHttpCommandHttpResponseInputStream() {
       AWSError error = utils.parseAWSErrorFromContent(command.getCurrentRequest(), response(getClass()
diff --git a/core/src/main/java/org/jclouds/http/HttpUtils.java b/core/src/main/java/org/jclouds/http/HttpUtils.java
index 5b636a99f4..0d41d7c83f 100644
--- a/core/src/main/java/org/jclouds/http/HttpUtils.java
+++ b/core/src/main/java/org/jclouds/http/HttpUtils.java
@@ -121,8 +121,9 @@ public class HttpUtils {
 
    public static byte[] toByteArrayOrNull(PayloadEnclosing response) {
       if (response.getPayload() != null) {
-         InputStream input = response.getPayload().getInput();
+         InputStream input = null;
          try {
+            input = response.getPayload().openStream();
             return toByteArray(input);
          } catch (IOException e) {
             propagate(e);