I have created a Provider identity and an associated IAM role to use OIDC, but how do I actually enable it at a config level? If I try to assumeRoleWithWebIdentity it requires a

web_identity_token

? But I assume this would be generated by Pulumi at deploy time?

config:
    aws:assumeRoleWithWebIdentity:
        roleArn: arn:aws:iam::<account_id>:role/<role_name>