The STS service returns temporary session credentials which you should be able to pass to just about any Amazon service in place of normal AWS credentials. However, not all boto class constructors accept the additional security_token parameter.
Add security_token parameter to more constructors. Fixes #792.
Forgot to fix cloudfront module in last commit for #792.