Error auth in different okta org domain using credential_process

[kimxogus]

Issue

I'm using okta-aws-cli with credential_process like aws config file below,

[profile aaa]
credential_process = okta-aws-cli web --format "process-credentials" --oidc-client-id "..." --aws-acct-fed-app-id "..." --org-domain "aaa.okta.com" --aws-iam-idp "..." --aws-iam-role "..." --open-browser

[profile bbb]
credential_process = okta-aws-cli web --format "process-credentials" --oidc-client-id "..." --aws-acct-fed-app-id "..." --org-domain "bbb.okta.com" --aws-iam-idp "..." --aws-iam-role "..." --open-browser

I get okta api error when I switch aws profiles having different okta org domain

$ AWS_PROFILE=aaa aws sts get-caller-identity
# success

$ AWS_PROFILE=bbb aws sts get-caller-identity
Error when retrieving credentials from custom-process: Error: Okta API returned an error: 'subject_token' is invalid.
Usage:
  okta-aws-cli web [flags]
...

Workaround

Run rm ~/.okta/awscli-access-token.json and then run awscli again

$ AWS_PROFILE=a aws sts get-caller-identity
# success

$ rm ~/.okta/awscli-access-token.json

$ AWS_PROFILE=b aws sts get-caller-identity
# success
...