Since we are using temporary AWS credentials, we need to
pass a session token as well as the usual access key ID
and secret.