Should support deleting any individual creds, not just the SSO token which is used to get new IAM STS creds