Dynamic AWS IAM Credentials with Vault for Zero Trust Clouds

Act as a Cloud IAM Architect. Establish a flawless Zero Trust cloud identity model by deploying the HashiCorp Vault AWS Secrets Engine to programmatically generate highly dynamic, ephemeral AWS IAM credentials exclusively for accessing [AWS_SERVICE] (e.g., S3 or DynamoDB). You must define the precise Vault role payload mapped to a highly restrictive, JSON-formatted [IAM_POLICY_TYPE] (e.g., forcing `s3:GetObject` only). Establish and enforce an aggressive, non-negotiable [MAX_LEASE_TTL] (e.g., 15 minutes) for the generated credentials. Write a deeply technical brief explaining the architectural distinction and massive security benefits of configuring Vault to generate STS 'AssumedRole' tokens (which do not create permanent IAM users) versus generating actual 'IAM User' access keys. Provide the exact developer workflow demonstrating how an engineer uses Vault to acquire these temporary credentials via the CLI without ever touching the AWS Console.