Phantom instance must assume-role first. To do this from the command-line:
aws --region us-gov-east-1 sts assume-role --role-arn arn:aws-us-gov:iam::738800754746:role/service/phantom_s3 --role-session-name ftd_testing
# Output will contain AccessKeyId and SecretAcessKeyID
AWS_ACCESS_KEY_ID=[REPLACE] AWS_SECRET_ACCESS_KEY=[REPLACE] AWS_SESSION_TOKEN=[replace] aws --region us-gov-east-1 s3 ls