As it would turn out, if one uses security tokens (from AWS STS, and they come from session and federation flavors) with AWS, one needs Even More configuration than these.  So I think it's okay to give each vendor as much configuration as necessary and not pretend they all have the same approach to auth & auth.