AWS SSO Required permission to run aws sts get-caller-identity

For an AWS SSO user, when they run

`aws sts get-caller-identity`

the following error occurs

`An error occurred (ForbiddenException) when calling the GetRoleCredentials operation: No access`

I can't find any reference as to what permission the user needs to execute this command.

The user has the following policy:

arn:aws:iam::aws:policy/ReadOnlyAccess 

and this inline policy:

    {
            "Sid": "sts",
            "Effect": "Allow",
            "Action": "sts:GetServiceBearerToken",
            "Resource": "*",
            "Condition": {
                "NumericEquals": {
                    "sts:DurationSeconds": 43200
                },
                "StringEquals": {
                    "sts:AWSServiceName": "codeartifact.amazonaws.com"
                }
            }
        }
    ]