The security token included in the request is invalid - AWS SSO

I currently get the following error when trying to use `awslogs` on an account under AWS Control Tower and AWS SSO. Works fine on accounts not under SSO.
```
Traceback (most recent call last):
File "/Users/user/.pyenv/versions/3.7.3/bin/awslogs", line 8, in
sys.exit(main())
File "/Users/user/.pyenv/versions/3.7.3/lib/python3.7/site-packages/awslogs/bin.py", line 179, in main
getattr(logs, options.func)()
File "/Users/user/.pyenv/versions/3.7.3/lib/python3.7/site-packages/awslogs/core.py", line 229, in list_logs
consumer()
File "/Users/user/.pyenv/versions/3.7.3/lib/python3.7/site-packages/awslogs/core.py", line 170, in consumer
for event in generator():
File "/Users/user/.pyenv/versions/3.7.3/lib/python3.7/site-packages/awslogs/core.py", line 157, in generator
response = self.client.filter_log_events(**kwargs)
File "/Users/user/.pyenv/versions/3.7.3/lib/python3.7/site-packages/botocore/client.py", line 276, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/Users/user/.pyenv/versions/3.7.3/lib/python3.7/site-packages/botocore/client.py", line 586, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.errorfactory.UnrecognizedClientException: An error occurred (UnrecognizedClientException) when calling the FilterLogEvents operation: The security token included in the request is invalid
```

Start by reproducing the AWS SSO failure with the `awslogs` command, then trace the request path through `awslogs/bin.py` and `awslogs/core.py` shown in the traceback. Compare behavior between SSO and non-SSO accounts; done means CloudWatch log requests authenticate successfully for the affected account.

Written by the indexing model from the issue text.