Which method ensures least-privilege authentication across Terramate stacks?

Terramate orchestrates Terraform by generating HCL files from templates and managing stack-based variable propagation. While this reduces duplication across multi-account or multi-region deployments, the orchestration layer does not replace the underlying cloud provider's IAM requirements.

When managing multiple stacks that require distinct authentication contexts, there is a design uncertainty regarding how to handle credential rotation and least-privilege access without hardcoding sensitive data into templates or relying on a single, overly permissive identity for the orchestration process.

Does Terramate provide a native mechanism to map specific stack definitions to unique IAM roles during the generation phase? What is the recommended pattern for passing dynamic, short-lived credentials into the generated Terraform provider blocks to prevent credential expiration during long-running orchestration tasks?