Contrary to our notes and documentation, the server does not always use the arn returned by sts to look up the mapped user:

• If arn is an iam arn, the server uses it verbatim.
• If arn is an sts arn. the server replaces the last path component (scope?) of the last colon-separated component of the arn by asterisk.

I believe none of this is documented in the server manual (how to set up aws auth is in general not documented).