The Buildkite Agent's oidc command allows you to request an OpenID Connect (OIDC) token from Buildkite, representing the current pipeline and its job. These tokens can be exchanged for specific roles on federated systems like AWS, GCP, Azure and many others.
