AWS CLI: Get user details from Cognito Identities

Question

Using the AWS CLI, how to get user details (username, e-mail) from Cognito Identities?

This question relates to https://stackoverflow.com/a/55436168/1692112, which no longer seems to be working in 2021. The problem is, the sub attribute in the User Pool no longer matches the IdentityId in the Identity Pool.

List of users in the User Pool:

$ aws cognito-idp list-users --user-pool-id XX-XXXXX-X_XXXXXXXXX

{
    "Users": [
        {
            "Username": "my.username.yay",
            "Attributes": [
                {
                    "Name": "sub",
                    "Value": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
                },
                {
                    "Name": "email_verified",
                    "Value": "true"
                },
                {
                    "Name": "email",
                    "Value": "my.username.yay@my.company.yay"
                }
            ],
            "UserCreateDate": 1612361296.687,
            "UserLastModifiedDate": 1612361331.99,
            "Enabled": true,
            "UserStatus": "CONFIRMED"
        }
    ]
}

List of identities in the Identity Pool:

$ aws cognito-identity list-identities --identity-pool-id XX-XXXXXXXX-X:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX --max-results 50

{
    "IdentityPoolId": "XX-XXXXX-X:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
    "Identities": [
        {
            "IdentityId": "XX-XXXXXXX-X:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
            "Logins": [
                "cognito-idp.XX-XXXXXXX-X.amazonaws.com/XX-XXXXXXX-X_XXXXXXXXX"
            ],
            "CreationDate": 1612795279.758,
            "LastModifiedDate": 1612795279.771
        }
    ]
}

I had been sort of hoping that the list of Logins would somehow mention the username or sub, but it just references the whole User Pool.

Theoretically, it might be possible to use AWS Lambda and AWS Cognito Triggers to connect the two pools and store the IDs somewhere. However, I would assume that AWS Cognito already knows the connection between the two pools and that there's a simple command for the job.

Edit: It appears that even by the time the last Cognito trigger Pre Token Generation is invoked, the identity does not exist yet. Moreover, the event structure does not reference the identity anywhere. Thus, AWS Lambda and Cognito Triggers would not provide a workaround to the AWS CLI, either.

Any suggestions?