SOPS Can't Find Data Key Required to Decrypt the SOPS File (AWS KMS)

We are running into an issue on our Kubernetes pods (using kube2iam to provide IAM credentials to containers) trying to decrypt SOPS secrets where the assumed role tries to assume itself before decrypting.

Error message:

Failed to get the data key required to decrypt the SOPS file.
Group 0: FAILED
  arn:aws:kms:us-east-1:<account-id>:key/<uuid>: FAILED
    - | Error decrypting key: NoCredentialProviders: no valid
      | providers in chain. Deprecated.
      |     For verbose messaging see
      | aws.Config.CredentialsChainVerboseErrors
  
  arn:aws:kms:us-east-1:<account-id>:key/<uuid>: FAILED
    - | Error creating AWS session: Failed to assume role
      | "arn:aws:iam::<account-id>:role/service/<role-name>":
      | AccessDenied: User:
      | arn:aws:sts::<account-id>:assumed-role/<role-name>/<role-session-name>
      | is not authorized to perform: sts:AssumeRole on resource:
      | arn:aws:iam::<account-id>:role/service/<role-name>
      |     status code: 403, request id:
      | a401448b-6242-46d1-80d7-7e14396b4ad0
Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html

— Is there a reason why SOPS tries to assume a role already assumed?
— Is there a way to set the trust relationship of the role to be able to assume itself?

Start with the Kubernetes pod setup using kube2iam and the AWS KMS decryption path described in the error. Trace the credential chain and role-assumption request, then determine why the already-assumed role is used and record whether self-assumption is supported or required.