This will call buildkite-agent oidc request-token ... need that to run with the pipeline role before then assuming your IAM role like so: plugins: - artifacts#v1.9.4: download: "out/*" - ...

Add the profiles for each role you want to assume to ~/.aws/config. Specify the provider name from the configuration file, and override any default settings: [profile engineer] credential_process = ...