Executor from private AWS ECR with OIDC without IAM keys

Hi team,
is it possible to pull executor from AWS ECR repo using OIDC role and not using IAM keys?
As executor it is a first step, I can not imagine where I can provision OIDC role and assume it.
I tried to run executor from public repo and save credentials to workspace, but OIDC is not key-based auth.
So my second executor has failed (again).