Advanced Vault-Backed Terraform Dynamic Credentials

Act as a DevSecOps Automation Lead. Architect a zero-trust infrastructure deployment pipeline where Terraform absolutely never uses hardcoded, static API keys. Write the HCL configuration demonstrating exactly how the Terraform [CLOUD_PROVIDER] provider must authenticate directly against a HashiCorp Vault cluster, request dynamic, ephemeral credentials utilizing the highly restricted [VAULT_ROLE], and execute the infrastructure deployment. You must enforce a strict [LEASE_TTL] (e.g., 15 minutes) on these credentials to mathematically eliminate the blast radius of a credential leak. Explain the exact CI/CD runner OIDC configuration required to securely bootstrap the initial Vault token.