AWS SSO Users cannot encrypt/decrypt files using KMS Keys

Scenario
I have configured a profile for an AWS SSO User in AWS CLI (version 2.0.10). This SSO User has administrative access permission in the AWS Account. I have created a KMS Key and AWS IAM Role which was automatically created for this AWS SSO User (based on the permission set) has been added to the key policy to allow following actions.

"Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
"Resource": "*"

Problem
Cannot encrypt files with this AWS SSO User. I tried both ways to point the key ARN such as exporting SOPS_KMS_ARN environment variable and also providing it directly with --kms <arn-of-the-key>. Commands were executed in verbose mod to see logs too. The error appears as below.

[AWSKMS] INFO[0012] Encryption failed arn="arn:aws:kms:<region>:<account-id>:key/<key-id>" Error encrypting the data key with one or more master keys: [failed to encrypt new data key with master key "arn:aws:kms:<region>:<account-id>:key/<key-id>": Failed to call KMS encryption service: NoCredentialProviders: no valid providers in chain. Deprecated. For verbose messaging see aws.Config.CredentialsChainVerboseErrors]

I have given the KMS Key ARN in the correct way and everything works for AWS IAM Users. The issue is only when using AWS SSO Users. Is there anything related to this situation?

SOPS Version: 3.5.0

Start by reproducing encryption and decryption with the AWS CLI SSO profile, using the reported SOPS_KMS_ARN or --kms option and verbose output. Trace the AWS credential-provider handling used by the KMS encryption path; done means AWS SSO users can encrypt and decrypt with the configured KMS key without NoCredentialProviders.