AWS SSO legacy profile doesn't work with ansible

When running aws sso login --profile legacy the apply script doesn't work.

For example, ./apply staging dev-desktop -u marcoieni fails with the following error:

fatal: [dev-desktop-staging.infra.rust-lang.org]: FAILED! => {"msg": "The conditional check 'datadog_api_key is not defined and datadog_manage_config' failed.
The error was: An unhandled exception occurred while templating '{{ vars_datadog_api_key }}'. Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while templating '{{ ssm_all['datadog-api-key'] }}'.
Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while templating '{{ lookup('aws_ssm', '/staging/ansible/all/', region='us-west-1', shortnames=true, bypath=true, recursive=true) }}'.
Error was a <class 'ansible.errors.AnsibleLookupError'>, original message: Failed to access SSM parameter path /staging/ansible/all/ (AccessDenied)\n\nThe error appears to be in '~/.ansible/roles/datadog.datadog/tasks/main.yml': line 17, column 3,
but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Fail if API key is missing\n  ^ here\n"}

By logging in with the aws-creds.py script, the apply script works as expected.

It would be nice to be able to use sso for everything and delete the aws-creds.py from the repo.

EDIT: when deleting aws-creds.py, also close https://github.com/rust-lang/simpleinfra/issues/27

Start with the ansible/apply script and reproduce the failure using aws sso login --profile legacy and ./apply staging dev-desktop -u marcoieni. Compare this with credentials from aws-creds.py, then inspect the aws_ssm lookup and issue #27. Done means the apply command works with SSO and the legacy credential script can be removed as requested.