# OpenID Connect Support added to AWS CLI Orb - v3.1

**URL:** <https://discuss.circleci.com/t/openid-connect-support-added-to-aws-cli-orb-v3-1/43817>\
**Category:** Announcements\
**Created:** [April 26, 2022, 4:21pm UTC](https://discuss.circleci.com/t/openid-connect-support-added-to-aws-cli-orb-v3-1/43817 "2022-04-26T16:21:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brian](https://avatars.discourse-cdn.com/v4/letter/b/97f17d/32.png) [@Brian](https://discuss.circleci.com/u/Brian)\
**Post date:** [April 26, 2022, 4:21pm UTC](https://discuss.circleci.com/t/openid-connect-support-added-to-aws-cli-orb-v3-1/43817/1 "2022-04-26T16:21:44Z")

</div>

Hello everyone!

I’m happy to announce that version 3.1 of the `AWS CLI` Orb has been released as of April 21st, 2022. This latest version takes advantage of CircleCI’s OIDC Token that’s available by default in every context provided in each job. It enables users to generate a short-lived `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` and `AWS_SESSION_TOKEN` that’s only valid for 60 minutes by default. These short-lived keys are used in the `aws-cli/setup` command to configure a profile that can be used to access other AWS services defined by the `IAM` policies that are tied to the specified `role-arn`. This makes running CircleCI pipelines with AWS more secure since it eliminates the need for users to store static `AWS` keys as environment variables.

Here’s how it works:

1. You’ll need to create an OpenID Connect Identity provider in `IAM` and generate a `role-arn` using Web Identity. [You can find step by step directions here](https://circleci.com/blog/openid-connect-identity-tokens/).
2. Use the `role-arn` you’ve created in the previous step as a parameter in the `aws-cli/setup` command. You will also need to define a `profile-name`. After the `aws-cli/setup` command is run, you can use the profile you’ve defined to run other `AWS CLI` commands. The example below creates a profile with web identity called `WEB-IDENTITY-PROFILE` and uses it to log into `AWS ECR`

```auto
 version: 2.1

  orbs:
    aws-cli: circleci/aws-cli@3.1

  jobs:
    aws-cli-example:
      executor: cimg/base:current
      steps:
        - checkout
        - aws-cli/setup:
            profile-name: WEB-IDENTITY-PROFILE
            role-arn: arn:aws:iam::123456789012:role/WEB-IDENTITY-ROLE
            role-session-name: example-session
        - run: 
            name: Log into ECR
            command: aws ecr get-login-password --region us-west-2 --profile WEB-IDENTITY-PROFILE

  workflows:
    aws-cli:
      jobs:
        - aws-cli-example:
            context: AWS-CONTEXT

```

You can find more details in the [Orb Registry](https://circleci.com/developer/orbs/orb/circleci/aws-cli)