Using this with AWS GovCloud required the `--region us-gov-west-1` parameter. Perhaps we should add an optional `--region` argument to `stanford-sso.sh` Further, there are some hardcoded ARNs that are not applicable to GovCloud