Propose to include AWS role to ensure credentials are not exposed for running the scans

An AWS role can be passed as a command line parameter (for STS assume role) to scan an account without creating/exposing access keys. It should not be a major code change and I can contribute if you are okay with it.

Start by tracing how the command-line scan parameters receive AWS credentials and review the existing AWS authentication flow for an STS assume-role option. Done means an AWS role can be supplied without creating or exposing access keys and the scan can run against the target account.

Written by the indexing model from the issue text.