Can you add support for temporary AWS credentials?  You just have to pass AWS_SESSION_TOKEN, in addition to the usual AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, to the AWS APIs.
This will enable working with time-limited and multifactor-authentication-protected credentials.
