s3-client* now takes an optional session-token key allowing it to be used by ec2 instances that only have temporary credentials.