when running atlantis in kube cluster

x

with an aws provider configured like:

provider "aws" {
  region = "eu-west-2"

  assume_role {
    role_arn = var.terraform_role
  }
}

with a

<http://kms.tf|kms.tf>

like:

resource "aws_kms_key" "aurora_postgres_kms" {
  description = "${var.cluster_identifier} - Aurora Postgres RDS KMS"

  # tags
  tags = merge(
    {
      "Name" = "${var.cluster_identifier}-rds-kms"
      "Type" = "kms"
    },
    var.tags
  )
}

resource "aws_kms_alias" "aurora_postgres_kms_alias" {
  name          = "alias/${var.cluster_identifier}/rds-kms"
  target_key_id = aws_kms_key.aurora_postgres_kms.key_id
}

i'm seeing this error:

Error: AccessDenied: User: arn:aws:sts::xxxxxxxx:assumed-role/atlantis/redacted is not authorized to perform: kms:Decrypt on the resource associated with this ciphertext because the resource does not exist in this Region, no resource-based policies allow access, or a resource-based policy explicitly denies access
│ 	status code: 403, request id: xxxxxxx, host id: xxxxxxxxxredacted/xxxx/E=xxxxxxx

however this role is the role of the service account in kubernetes, not the one configured in my provider. is that normal?