aws-sdk-js-v3: Cannot use AWS SSO with assume role when source_profile uses the sso_session option

Checkboxes for prior research

• I’ve gone through Developer Guide and API reference
• I’ve checked AWS Forums and StackOverflow.
• I’ve searched for previous similar issues and didn’t find any solution.

Describe the bug

AWS SDK JS v3 is not able to resolve credentials of a profile with role_arn and source_profile fields when the source profile uses the sso_session option.

SDK version number

@aws-sdk/credential-provider-sso@3.338.0

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

v18.16.0

Reproduction Steps

1. Create file called config with following content:

[sso-session mysso]
sso_start_url = https://mysso.awsapps.com/start
sso_region = eu-west-1

[profile first_profile]
sso_session = mysso
sso_account_id = 000000000000
sso_role_name = MyRole

[profile second_profile]
source_profile = first_profile
role_arn = arn:aws:iam::000000000000:role/another_role

1. Create file called index.js with following content:

import {GetCallerIdentityCommand, STSClient} from "@aws-sdk/client-sts"

const client = new STSClient({});
const cmd = new GetCallerIdentityCommand({})
console.log(await client.send(cmd))

1. Execute the following command:

env AWS_CONFIG_FILE=./config AWS_REGION=eu-west-1 AWS_PROFILE=second_profile node index.js

Please note that the configuration with placeholder values for sso_start_url, sso_account_id, sso_role_name and role_arn fields is sufficient to reproduce the issue with the SDK (valid values are not required for exception to be thrown). However, to verify potential fixes you’ll need to fill in real values in the configuration.

Observed Behavior

AWS SDK JS v3 fails to resolve credentials with validation error on the source profile (“first_profile” in the example):

/example/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/validateSsoProfile.js:8
        throw new property_provider_1.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", ` +
              ^

CredentialsProviderError: Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url". Got sso_session, sso_account_id, sso_role_name
Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html
    at validateSsoProfile (/example/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/validateSsoProfile.js:8:15)
    at resolveSsoCredentials (/example/node_modules/@aws-sdk/credential-provider-ini/dist-cjs/resolveSsoCredentials.js:8:136)
    at resolveProfileData (/example/node_modules/@aws-sdk/credential-provider-ini/dist-cjs/resolveProfileData.js:28:66)
    at resolveAssumeRoleCredentials (/example/node_modules/@aws-sdk/credential-provider-ini/dist-cjs/resolveAssumeRoleCredentials.js:30:55)
    at resolveProfileData (/example/node_modules/@aws-sdk/credential-provider-ini/dist-cjs/resolveProfileData.js:16:80)
    at /example/node_modules/@aws-sdk/credential-provider-ini/dist-cjs/fromIni.js:8:56
    at async coalesceProvider (/example/node_modules/@aws-sdk/property-provider/dist-cjs/memoize.js:14:24)
    at async SignatureV4.credentialProvider (/example/node_modules/@aws-sdk/property-provider/dist-cjs/memoize.js:33:24)
    at async SignatureV4.signRequest (/example/node_modules/@aws-sdk/signature-v4/dist-cjs/SignatureV4.js:87:29)
    at async /example/node_modules/@aws-sdk/middleware-signing/dist-cjs/middleware.js:16:18 {
  tryNextLink: false,
  '$metadata': { attempts: 1, totalRetryDelay: 0 }
}

Expected Behavior

AWS SDK JS v3 is able to resolve credentials for the profile that assumes a role using a profile that for which an SSO session provides some of the SSO related configuration values. Here’s how the same config works with AWS CLI v2:

 env AWS_CONFIG_FILE=./config AWS_REGION=eu-west-1 AWS_PROFILE=second_profile aws sts get-caller-identity
{
    "UserId": "AROA3KHW7455TPABCRXHN:botocore-session-1684992352",
    "Account": "000000000000",
    "Arn": "arn:aws:sts::000000000000:assumed-role/another_role/botocore-session-1684992352"
}

Possible Solution

No response

Additional Information/Context

No response