Support short-term / temporary AWS credentials

[TomAugspurger]

AWS supports short-term / temporary AWS credentials. The concept is described at https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html, but the basic idea is that in addition to AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, you provide an AWS_SESSION_TOKEN which is a short-lived token. https://docs.aws.amazon.com/cli/v1/userguide/cli-authentication-short-term.html is an example with the AWS CLI and configuration file.

I think https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html gives an overview of the flow and links to the spec, but I think the basic idea is to make an initial request to the STS service and include the returned AWS_SESSION_TOKEN where you'd normally use AWS_SECRET_ACCESS_KEY.