Why do AWS credentials seem to go missing when creating a kinesis client from a session with the Go SDK?

Question

I'm trying to list Kinesis streams

session, err := session.NewSessionWithOptions(session.Options{
    Config: aws.Config{Region: aws.String("sa-east-1"),
        CredentialsChainVerboseErrors: aws.Bool(true)},
    Profile: profile,
})
client := kinesis.New(session)
streams, err := client.ListStreams(client.ListStreamsInput{})

The profile is correct and the region is correct but streams is always an empty list, despite there being one stream existing with those parameters. Can you advise why I don't see the stream?

I'm using the Delve debugger with vscode and can see this, where creds has nothing in AccessKeyId etc.

I've made sure that the credentials are being pointed to with the full path and they contain the required access key and secret.

From the docs

By default NewSession will only load credentials from the shared credentials file (~/.aws/credentials).

I also tried

session, err := session.NewSessionWithOptions(session.Options{
    // Specify profile to load for the session's config
    Profile: profile,

    // Provide SDK Config options, such as Region.
    Config: aws.Config{
        Region: aws.String("sa-east-1"),
    },

    // Force enable Shared Config support
    SharedConfigState: session.SharedConfigEnable,
}

but that returns

Could not initiate Kinesis client. Error: AssumeRoleTokenProviderNotSetError: assume role with MFA enabled, but AssumeRoleTokenProvider session option not set