Install.

Install script

curl --proto '=https' --tlsv1.2 -LsSf \
  https://dialohq.github.io/aws-google-oidc/install.sh | sh

Nix

Use the github:dialohq/aws-google-oidc flake. Prebuilt outputs are available from the aws-google-oidc Cachix cache.

Add an AWS profile.

[profile google-oidc]
region = eu-central-1
credential_process = aws-google-oidc
  --profile google-oidc
  --region eu-central-1
  --role-arn arn:aws:iam::123456789012:role/google-oidc
  --impersonate-service-account aws-users@example.iam.gserviceaccount.com
  --audience aws-google-oidc

For Ceph or another STS-compatible service, add --sts-endpoint-url URL.

Run the AWS CLI.

gcloud auth login
aws sts get-caller-identity --profile google-oidc

The AWS CLI invokes the credential process automatically.