Using adminAssumeRole in KMS: encryption works fine; decryption gives `No keys found in file`

This is almost probably my fault with respect to how KMS is setup, but the problem I am reporting deals more with the fact that if SOPS can encrypt something (using KMS) then it doesn't make sense that no keys exist for decryption.

My setup:

• AWS master account contains two KMS symmetrical keys.
• master account: policies and role in place to allow role assumption for the created keys
• dev account: contains policies and role to allow role assumption to created keys in master account

Trying to find solid and thorough documentation on .sops.yaml is challenging. The README has good stuff, but it's not thorough. Here's my .sops.yaml:

---
creation_rules:
  - arn: 'arn:aws:kms:us-east-1:<master-account REDACTED>:key/80f48cc5-<REDACTED>' # us east 1
    role: 'arn:aws:iam::<dev-account REDACTED>:role/adminAssumeRole'
  - arn: 'arn:aws:kms:us-west-2:<master-account REDACTED>:key/541575ba-<REDACTED>' # us west 2
    role: 'arn:aws:iam::<dev-account REDACTED>:role/adminAssumeRole'

Using a test yaml file:

Here's my encryption output:

✦3 at 11:18:34 ❯ sops --verbose -e assume-role-secret.yaml 
secrets:
    password: ENC[AES256_GCM,data:miQ6/3CWC5uWSLNpP/zWwKFa+g==,iv:G83BetwngWg1bbcNiUL4io1Lu9tkZouLc7Ts0DkQOzY=,tag:u1kOtm1XFIDMJBl9MC2j7Q==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    lastmodified: '2021-01-21T18:18:59Z'
    mac: ENC[AES256_GCM,data:QEQqMZJn4gzo4TTebzq6EnHNzvMt9UzTn5qELYKFtDUkOHh+VLQu+ZRDlBRP1UwEx5xxfFUj7PhRUjWGjDOsczm/Cb7Xc30O2fMFF8NRwcrKvPBM2IVPk/G8UYyT3lB1sR4wHXlbFjg2Lz0tSMbKts07/ebKH7/om6vFWqmsx08=,iv:GIQxgAsRG2KTtKprjcwZxxJa3l5BovIFGBNf/MXcKjw=,tag:W7sOM0Fd4qqxDwb+Oam8Lw==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.6.1

I don't see how it's possible to have successfully encrypted something using a symmetrical key from AWS and not have the key listed in the kms list.

Start with the README’s .sops.yaml guidance and the shown creation_rules configuration, then reproduce the sops --verbose -e assume-role-secret.yaml command against the provided AWS KMS setup. Trace why the encrypted output has an empty kms list and verify whether decryption succeeds or the configuration guidance needs clarification.