How to use k8s ServiceAccount to assume correct AWS Role (IRSA)? Running a Spring Boot app on EKS

I have Spring Boot (2.6.6) app running in a EKS cluster that tries to authenticate AWS by assuming an AWS role. I've followed this doc so far.

<dependencies>
    <dependency>
        <groupId>com.amazonaws</groupId>
        <artifactId>aws-java-sdk-sts</artifactId>
        <version>1.12.9</version>
    </dependency>
</dependencies>

And in my application helm/k8s setup:

apiVersion: apps/v1
kind: Deployment
spec
  template:
    metadata:
      ...
    spec:
      serviceAccountName: myapp-service-account
      securityContext:
        fsGroup: 123456
      initContainers:
      ...

ServiceAccount setup:

~ % kubectl get serviceaccounts -n dev                                                   
NAME                         SECRETS   AGE
default                      1         2y1d
myapp-service-account        1         7d2h
..

~ % kubectl get serviceaccounts/myapp-service-account   -n dev -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::<account_id>:role/<aws_role_to_assume>
..

But my app doesn't seem to assume the correct role:

2022-06-21 17:50:25.284 WARN [my-app,,] 1 --- [ main] s.AwsSecretsManagerPropertySourceLocator : Unable to load AWS secret from /secret/my-app_dev. User: arn:aws:sts::<account_id>:assumed-role/<cluster_generated_default_role> is not authorized to perform: secretsmanager:GetSecretValue on resource: /secret/my-app_dev because no identity-based policy allows the secretsmanager:GetSecretValue action (Service: AWSSecretsManager; Status Code: 400; Error Code: AccessDeniedException; Request ID: 1111111-2222-33333-444444; Proxy: null)

In above, I thought adding serviceAccountName: myapp-service-account would allow the app to somehow pick up the new ServiceAccount and thus assume a different role. What am I misconfiguring here?

EDIT

Environment variables:

~ % kubectl exec my-app-pod-1234-abcd -n dev -- env
...
JAVA_OPTS=
AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/eks.amazonaws.com/serviceaccount/token
AWS_ROLE_ARN=arn:aws:iam::<aws_account_id>:role/<aws_role_to_assume>
...