AWS CLIをAWS IAM Identity Center(SSO)で認証させるには?

$ aws --version
aws-cli/2.7.24 Python/3.8.8 Linux/4.14.133-113.105.amzn2.x86_64 botocore/1.13

$ aws --version
aws-cli/1.27.52 Python/3.10.8 Darwin/21.3.0 botocore/1.29.52

$ aws sso
Note: AWS CLI version 2, the latest major version of the AWS CLI, is now stable and recommended for general use. For more information, see the AWS CLI version 2 installation instructions at: https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html

usage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]
To see help text, you can run:

  aws help
  aws <command> help
  aws <command> <subcommand> help
aws: error: the following arguments are required: operation

~$ aws configure sso
SSO session name (Recommended): my-sso
SSO start URL [None]: https://d-1234.awsapps.com/start
SSO region [None]: us-east-1
SSO registration scopes [sso:account:access]:
Attempting to automatically open the SSO authorization page in your default browser.
If the browser does not open or you wish to use a different device to authorize this request, open the following URL:

https://device.sso.us-east-1.amazonaws.com/   ← 認証用URL

Then enter the code:

ABCD-EFGH ← 認証コード

~$ aws configure sso
SSO session name (Recommended): my-sso
SSO start URL [None]: https://d-1234.awsapps.com/start
SSO region [None]: us-east-1
SSO registration scopes [sso:account:access]:
Attempting to automatically open the SSO authorization page in your default browser.
If the browser does not open or you wish to use a different device to authorize this request, open the following URL:

https://device.sso.us-east-1.amazonaws.com/

Then enter the code:

ABCD-EFGH
There are 2 AWS accounts available to you.
  foo, web@example.com (11111111)
> bar, main@example.com (22222222)

~$ aws configure sso
SSO session name (Recommended): my-sso
SSO start URL [None]: https://d-1234.awsapps.com/start
SSO region [None]: us-east-1
SSO registration scopes [sso:account:access]:
Attempting to automatically open the SSO authorization page in your default browser.
If the browser does not open or you wish to use a different device to authorize this request, open the following URL:

https://device.sso.us-east-1.amazonaws.com/

Then enter the code:

ABCD-EFGH
There are 2 AWS accounts available to you.
Using the account ID 22222222
The only role available to you is: AdministratorAccess
Using the role name "AdministratorAccess"
CLI default client Region [ap-northeast-1]:
CLI default output format :
CLI profile name [AdministratorAccess-22222222]:

To use this profile, specify the profile name using --profile, as shown:

aws s3 ls --profile AdministratorAccess-22222222

~$ aws s3 ls --profile AdministratorAccess-22222222
2022-11-28 21:14:50 your-bucket-name

~$ aws sts get-caller-identity --profile AdministratorAccess-22222222
{
    "UserId": "AROXXXXXXXXX:test",
    "Account": "22222222",
    "Arn": "arn:aws:sts::22222222:assumed-role/AWSReservedSSO_AdministratorAccess_abcdef/test"
}

[default]
region = ap-northeast-1
output = json

; AWSアカウント向け設定
[profile AdministratorAccess-22222222]
sso_session = my-sso
sso_account_id = 22222222
sso_role_name = AdministratorAccess
region = ap-northeast-1
output = json

; IAM Identity Center向け設定
[sso-session my-sso]
sso_start_url = https://d-1234.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access

[default]
region = ap-northeast-1
output = json

[profile AdministratorAccess-22222222]
sso_session = my-sso
sso_account_id = 22222222
sso_role_name = AdministratorAccess
region = ap-northeast-1
output = json

[profile AdministratorAccess-11111111]
sso_session = my-sso
sso_account_id = 11111111
sso_role_name = AdministratorAccess
region = ap-northeast-1
output = json

; IAM Identity Center向け設定
[sso-session my-sso]
sso_start_url = https://d-1234.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access

$ aws s3 ls --profile 設定を追記したアカウントのプロファイル

$ aws s3 ls --profile YOUR-PROFILE

Error when retrieving token from sso: Token has expired and refresh failed

$ aws s3 ls --profile YOUR-PROFILE

.aws/
├── cli
│   └── cache
│       └── 123.json
├── config
└── sso
    └── cache
        ├── 456.json
        └── 789.json

{
  "clientId": "your-client-id",
  "clientSecret": "xxx.yyyy.zzz-in-jwt-format",
  "expiresAt": "2023-04-28T08:39:08Z",
  "scopes": [
    "sso:account:access"
  ]
}

{
  "startUrl": "https://d-123.awsapps.com/start",
  "region": "us-east-1",
  "accessToken": "your-access-token",
  "expiresAt": "2023-01-30T09:41:21Z",
  "clientId": "your-client-id",
  "clientSecret": "secret.in.jwt",
  "refreshToken": "your-refresh-token"
}

$ aws sso get-role-credentials \
  --account-id 111111111111 \
  --role-name AdministratorAccess \
  --access-token "your-access-token" \
  --region us-east-1

{
    "roleCredentials": {
        "accessKeyId": "your-access-key",
        "secretAccessKey": "your-secret-access-key",
        "sessionToken": "your-session-token",
        "expiration": 1674899972000
    }
}

$ export AWS_ACCESS_KEY_ID=AS...
$ export AWS_SECRET_ACCESS_KEY=your-secret-access-key
$ export AWS_SESSION_TOKEN=your-session-token

$ aws sts get-caller-identity
{
    "UserId": "DUMMY:foo",
    "Account": "111111111111",
    "Arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_AdministratorAccess_xxx/foo"
}

$ aws s3 ls
...

~$ ls -1 ~/.aws/cli/cache
123.json

~$ cat ~/.aws/cli/cache/123.json | jq .
{
  "ProviderType": "sso",
  "Credentials": {
    "AccessKeyId": "aaa",
    "SecretAccessKey": "bbb",
    "SessionToken": "...",
    "Expiration": "2023-01-30T09:42:53Z"
  }
}