Unless I'm missing something, isn't this whole process made a lot simpler just by using STS?

It also works incredibly well with Vault's STS backend.