Story

As an administrator of cluster log forwarding,
I need to use an STS Role for authenticating to CloudWatch
so that my deployment does not rely on static access keys

Acceptance Criteria

• Logs are written to CW when configured with STS Role for authentication
• "role" is a recognized secret key for authorization (Maybe "Role" depending upon the precedent of the other Keys)
• "role_arn" is the recognized key when using sts, and it must specify a correctly formatted arn"   ex.  arn:aws:iam::123456789012:role/my-new-role

Notes

• Enabling STS: https://github.com/fluent-plugins-nursery/fluent-plugin-cloudwatch-logs#configuring-the-plugin-for-sts-authentication
• Role takes precedence over other credentials

Moto the AWS mock seems to implement STS:

https://stackoverflow.com/questions/42542879/moto-mocking-sts-to-get-account-id-throwing-error-notimplementederror-the-get-c