Why does TLS 1.3 AES cipher require both a server and client traffic key/iv? During the TLS 1.3 handshake using the cipher suite TLS_AES_128_GCM_SHA256 a server and client traffic key/iv will be derived using HKDF based on the shared secret, see rfc8446 #7.1
Why is it necessary to derive the key/iv for both the server and client instead of a single key/iv for encryption and decryption?
Why is it necessary to derive the key/iv for both the server and client instead of a single key/iv for encryption and decryption?

Of course, it's not necessary for TLS 1.3 to be designed that way, however that's the way they decided to do it.
As for why, well, for all the encryption modes supported in TLS 1.3, it is necessary for security to never encrypt two different records with the same key/nonce combination.  With the current record design, the encryptor selects the nonce; hence, if two different encryptors (the client and the server) had the same key and selected the same nonce, well, things would be broken.
Now, they could have partitioned the nonce space; for example, tell the servers &quot;you always encrypt with a nonce that starts with a &quot;0&quot; bit&quot; and clients &quot;you always encrypt with a nonce that starts with a &quot;1&quot; bit&quot;; that would work, however they declined to do so.