A bit more detail about my config.
At this point, I run
export AWS_PROFILE=bilbo-admin
then run
aws sso login
at some point before running my npx ampx sandbox command.
and my config file looks like this:
`[profile bilbo-admin]
sso_session = amplify-sso
sso_account_id = 123456
sso_role_name = AdministratorAccess
region = us-east-1
output = json
credential_process = aws configure export-credentials --profile bilbo-admin
[sso-session amplify-sso]
sso_start_url = https://d-123456.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access`
the magic in credential_process is that it sets the right values from the command in the environment whenever a AWS utility tries to use that profile. Apparently you can put the aws sso login command there, too, which is pretty odd given that the docs say that this expects structured json output which that command doesn't give you. Just more magic...
Note with this setup I don't need to directly mess with the credentials file at all.
Finally, the ./amplify/.config directory referenced in the github issue above doesn't exist in my current project. This might be a carryover from the earlier version.