Session token (from AWS STS) can be passed in as a parameter