When using EKS Pod Identity add-on, sessions are automatically tagged with transitive tags.
There are two issues with this:
All roles transitively must have sts:TagSession
in their trust policy, something that might not be feasible if not all roles are owned by the same organization.
The automatic tags contain information like cluster's ARN which might not be desired to "share" with accounts down the assume role chain (through CloudTrail).
I found out that (and correct me if I'm am wrong):
What other options do I have?
Just now, AWS added an options to disable session tags. This options is found in the "Pod Identity Association" section of the Access section of the EKS cluster.