AWS SSO does offer this "out of the box", but many large organizations use their own custom SSO setup with custom-built tools to get temporary tokens.