Securing Multi-Cloud Environments with Vault Identity Secrets Engine

Act as a Multi-Cloud Security Expert. Architect an advanced, cross-cloud Zero Trust identity brokering system exclusively utilizing HashiCorp Vault's internal Identity Secrets Engine. You must build a cryptographic bridge securely federating identities seamlessly between [PRIMARY_CLOUD] (e.g., AWS) and [SECONDARY_CLOUD] (e.g., Azure) environments utilizing a centralized [SSO_METHOD] (e.g., Okta OIDC). Detail exactly how to programmatically construct Identity 'Entities' and 'Groups' within Vault's internal database that map perfectly 1:1 to the native, disparate cloud IAM roles. Provide a complex, functional HCL example demonstrating the use of 'Entity Aliases'—proving mathematically how a single, unified Vault identity allows a serverless function in AWS to securely authenticate and access a Vault secret originally scoped exclusively for an Azure Service Principal, completely bypassing the need to re-authenticate or manage parallel credentials.