Do AWS Canonical UserIDs exist for AWS Federated Users (temporary security credentials)?
Contacted the author of boto and learned of:
get_canonical_user_id() for the S3Connection class.
This will give you the canonical user ID for the credentials associated with the connection.  The connection will have to have been used for some operation (e.g.: listing buckets).
Very awkward, but possible.
Does a canonical user id exist for a federated user created using STS?  When using boto I need a canonical user id to grant permissions to a bucket.  
Here's a quick tour through my code:

I've successfully created temporary credentials using boto's STS module (using a "master" account), and this gives me back:

federated_user_arn
federated_user_id
packed_policy_size
access_key
secret_key
session_token
expiration

Then I create the bucket using boto:
bucket = self.s3_connection.create_bucket('%s_store' % (app_id))
Now I want to grant permissions I'm left with two choices in boto:
add_email_grant(permission, email_address, recursive=False, headers=None)
add_user_grant(permission, user_id, recursive=False, headers=None, display_name=None)

The first method isn't an option since there isn't an email attached to the federated user, so I look at the second.  Here the second parameter ("userid") is to be "The canonical user id associated with the AWS account your are granting the permission to." But I can't seem to find a way to come with this for the federated user.
Do canonical user ids even exist for federated users?  Am I overlooking an easier way to grant permissions to federated users?