AWS STS AssumeRoleWithWebIdentity should not require credentials or signing.