There are a few problems here. First I can not reproduce the original issue (more on that below). Second, it is not the AWS plugin that updates the K8s secrets, that is done by the CSI driver itself running under a different service account. Also, the CSI driver is already setting up these permission on their role when sync is turned on. We also would not set these permission globally for all installations as they don't all use K8s secrets (which is why the CSI driver does them conditionally).

I suspect what may have happened is an older version of the CSI driver was not setting the role permission correctly on upgrade or something was set by hand interfering with it. When I upgrade the sync option on the latest CSI driver I do see the cluster role setup correctly:

$ helm install -n kube-system csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver
$ kubectl -o yaml -n kube-system get clusterroles secretprovidersyncing-role
Error from server (NotFound): clusterroles.rbac.authorization.k8s.io "secretprovidersyncing-role" not found

$ helm upgrade -n kube-system csi-secrets-store secrets-store-csi-driver/secrets-store-csi-driver --set syncSecret.enabled=true
$ kubectl -o yaml -n kube-system get clusterroles secretprovidersyncing-role
    ...
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch

As to the annotation on the service account, this is the service account for the AWS provider daemonset, there is no IAM role associated with it. The role association and annotation should be on the application SA, and this is typically done for each application pod using eksctl create iamserviceaccount.