https://www.adamkielar.pl/posts/how-to-use-openid-connect-identity-tokens-to-authenticate-circleci-jobs-with-aws/