Decryption failed when different aws-profile names used

This is a strange one, I seem to only be able to decrypt files that are made by the user that created the file.

If I try and decrypt another file it fails. Even though both files are encrypted with the same KMS key and both users have permissions to access the key within AWS.

sops --verbose --aws-profile saml -d madebyme.yaml

[AWSKMS]	 INFO[0000] Decryption succeeded                          arn="arn:aws:kms:us-west-2:123456:key/123123123123"
[SOPS]	 INFO[0000] Data key recovered successfully              
[SOPS]	 DEBU[0000] Decrypting tree                              
hello: Welcome to SOPS! Edit this file as you please!

sops --verbose --aws-profile saml -d madebyanother.yaml

[AWSKMS]	 INFO[0012] Decryption failed                             arn="arn:aws:kms:us-west-2:123456:key/123123123123"
[AWSKMS]	 INFO[0024] Decryption failed                             arn="arn:aws:kms:us-east-2:123456:key/456456456456"
Failed to get the data key required to decrypt the SOPS file.

Group 0: FAILED
  arn:aws:kms:us-west-2:123456:key/123123123123: FAILED
    - | Error decrypting key: NoCredentialProviders: no valid
      | providers in chain. Deprecated.
      | 	For verbose messaging see
      | aws.Config.CredentialsChainVerboseErrors
  
  arn:aws:kms:us-east-2:123456:key/456456456456: FAILED
    - | Error decrypting key: NoCredentialProviders: no valid
      | providers in chain. Deprecated.
      | 	For verbose messaging see
      | aws.Config.CredentialsChainVerboseErrors

Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.

If I use the AWS CLI I can also encrypt and decrypt files manually. Any ideas what else I should try?

Start by reproducing the two sops commands with the saml AWS profile and comparing them with the successful AWS CLI encryption and decryption. Investigate why the second file reports NoCredentialProviders for both KMS ARNs; done means decrypting another user's file with the shared KMS key and permitted credentials.