Client sends his session cookies to AWS

elgg_register_plugin_hook_handler('action', 'login', function ($hook, $entity_type, $returnvalue, $params){
  // command to send session cookie to AWS
  return true;
});

Elgg would be able to revoke authorisations (e.g. on logout)

elgg_register_plugin_hook_handler('action', 'logout', function ($hook, $entity_type, $returnvalue, $params){
  // command to destroy session cookie to AWS
  return true;
});

AWS contacts Elgg to verify client's tokens/AWS would periodically check tokens

This can easily achieved using API

Thank you.

From a security perspective, is it sufficient to compare the cookie called "Elgg" received from the client and the one received from your snippet to consider the user "legit"? (Using only HTTPs)

Kerjo,

do you mind sharing your process for upgrading from 2.3.x to 3.x

Upgrade the code base (using git or composer) then just run "php ./elgg-cli upgrade async", you should be done.
You may want to remove dbencoding value from elgg-settings

http://learn.elgg.org/en/3.0/admin/upgrading.html