Do you have a doc link covers this (the fact that only region name is required and adding other kwargs can cause issues) that you can place here in a comment?

Unfortunately not, this something which not well covered in boto3 documentation.
Initially boto3.session.Session create low-level botocore session or use provided botocore.session and after that it applied explicit credentials if it provided.

botocore has only short info about itself in documentation which not cover how to work with their session. Let me refer to code boto3 and botocore

boto3.session.Session init constructor

if aws_access_key_id or aws_secret_access_key or aws_session_token:
    self._session.set_credentials(
        aws_access_key_id, aws_secret_access_key, aws_session_token
)

botocore.session.set_credentials

When we create botocore session for assume_role we use a bit hacky approach (access to private methods/properties)

So if we provide:

1. aws_access_key_id or aws_secret_access_key or aws_session_token it will replace assumed credentials in botocore session. We already use this credentials when assume role
2. profile_name - might be nothing bad happen but better do not provide it, since we already use it during session creation
3. region_name - Nothing bad happen, we use exactly the same region_name as user provide for initial and assume_role sessions. For initial session region_name only affect to endpoint for STS

Hmm, okay, I don't really like codifying assumptions against a non-public API, but this seems like a valuable fix if you're seeing issues with the current implementation.

There is a lot of grey zones in boto3, botocore and BaseSessionFactory. I can't find any valuable information about boto3.session.Session and best practices except this:

• https://boto3.amazonaws.com/v1/documentation/api/latest/guide/session.html
• https://boto3.amazonaws.com/v1/documentation/api/latest/reference/core/session.html

Also when i tried to found best practices how to assign RefreshableCredentials to boto3.session.Session I usual found on the Internet something like: SO link 1, SO link 2, some link from top 10 in Google search

So I wasn't surprised when I initially sow how it resolved in provider

 session = botocore.session.get_session() 
 session._credentials = credentials 
 region_name = self.basic_session.region_name 
 session.set_config_variable("region", region_name)

Let's me try to add some additional information why we set some parameters and not set another. It might help next time when someone add changes and broke something.