Automating Vault Cluster Deployment for High Availability Zero Trust

Act as an Infrastructure-as-Code Security Expert. Create an uncompromising, production-grade [INFRA_AS_CODE_TOOL] (e.g., Terraform or AWS CDK) module specifically engineered to deploy a highly available, fault-tolerant HashiCorp Vault Enterprise cluster. The architecture must utilize [STORAGE_BACKEND] (e.g., Integrated Raft Storage) for the backend data store, and the physical compute nodes must be distributed perfectly across [REGION_COUNT] distinct availability zones or geographic regions to survive a data center cratering. You must implement and code the native Auto-Unseal architecture utilizing a cloud-native KMS (e.g., AWS KMS or Azure Key Vault) to ensure the cluster can survive arbitrary reboots without human shard-holders present. Finally, architect and document the strict, required AWS Security Group / Network ACL rules needed to support a Zero Trust model, focusing exclusively on heavily encrypted gossip protocol and internal RPC communication between the Vault server nodes.