It'd be really cool if the credentials provider could take a scope down policy as one of its arguments (just as it takes an external ID, session name, etc now).
https://github.com/aws/aws-sdk-java/blob/master/aws-java-sdk-sts/src/main/java/com/amazonaws/auth/STSAssumeRoleSessionCredentialsProvider.java#L298