Advanced Terraform Dynamic Provider Credentials via Vault

Act as a DevSecOps Automation Lead. Architect a zero-trust infrastructure deployment pipeline where Terraform absolutely never uses hardcoded, static API keys (e.g., AWS Access Keys or Azure Client Secrets). Write the HCL configuration demonstrating exactly how the Terraform [CLOUD_PROVIDER] provider must authenticate directly against a central HashiCorp Vault cluster via OIDC, request dynamic, ephemeral credentials utilizing the highly restricted [VAULT_ROLE], and execute the infrastructure deployment. You must enforce a strict [LEASE_TTL] (e.g., 15 minutes) on these credentials to mathematically eliminate the blast radius of a credential leak. Explain the exact CI/CD runner configuration required to securely bootstrap the initial Vault token without exposing it in the logs.