sts:AssumeRole fails for sso user and iam account user

I am running the command with:

`python enablesecurityhub.py --master_account snip --assume_role arn:aws:iam::snip:role/enableSecHub --enabled_regions us-east-1,us-east-2 --enable_standards arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0 accounts.csv`

`Invalid account number Account ID, skipping
Enabling members in these regions: ['us-east-1', 'us-east-2']
Enabling the following Security Hub Standards for enabled account(s) and region(s): ['arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0']
Traceback (most recent call last):
File "enablesecurityhub.py", line 254, in
master_session = assume_role(args.master_account, args.assume_role)
File "enablesecurityhub.py", line 53, in assume_role
RoleSessionName='EnableSecurityHub'
File "/Users/a/Library/Python/2.7/lib/python/site-packages/botocore/client.py", line 316, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/Users/a/Library/Python/2.7/lib/python/site-packages/botocore/client.py", line 635, in _make_api_call
raise error_class(parsed_response, operation_name)botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::snipped is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::snip:role/arn:aws:iam::snip:role/enableSecHub`

I have tried creating roles and policies to explicitly allow either user and neither have worked. I have also tried running this locally and from within a ec2 instance inside the master account with associated iam resources.

Expected result is the script to complete successfully with various aws accounts reporting in to the master account.