Then, as alluded to in the last section, you can link IAM to an OIDC identity provider to hand your workloads temporary role credentials

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr...