Skip to content

fix(iac/aws): grant deploy role KMS key-lifecycle for OIDC signing-key replace #1496

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cristim merged 2 commits into from
Jul 23, 2026
Merged

fix(iac/aws): grant deploy role KMS key-lifecycle for OIDC signing-key replace #1496

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
58fcc51
fix(iac/aws): grant deploy role KMS key-lifecycle for OIDC signing-ke…
cristim Jul 22, 2026
c96e856
fix(iac/aws): match KMS tag condition on Project casing, drop no-op g…
cristim Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 21 additions & 2 deletions terraform/environments/aws/ci-cd-permissions/policy_compute.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,7 +320,8 @@ resource "aws_iam_policy" "compute" {
{
# KMS mutating + destructive actions are gated on the key being
# tagged Project=CUDly. The CUDly OIDC signing key is tagged at
# creation by Terraform (see modules/security/aws/kms_signing.tf).
# creation by Terraform (see modules/compute/aws/lambda/signing-key.tf,
# tags = merge(var.tags, ...)).
# Without this gate the deploy SA could schedule deletion or
# disable any KMS key in the account, causing denial of service
# for unrelated workloads.
Expand All @@ -330,9 +331,27 @@ resource "aws_iam_policy" "compute" {
# key-side check (tag-gated). The alias-side check lives in
# policy_compute_b.tf KMSAliasMutate (ARN-scoped because aliases
# have no IAM-visible tags).
# kms:CancelKeyDeletion lets the deploy SA reverse an
# in-progress ScheduleKeyDeletion on a CUDly-tagged key (e.g. a
# replace that gets interrupted before the new key is fully
# provisioned) without ever unlocking deletion of an unrelated
# account CMK.
#
# The condition uses StringEqualsIgnoreCase rather than
# StringEquals: the signing key's Project tag comes from
# local.common_tags (terraform/environments/aws/main.tf), which
# sets Project = var.project_name, and var.project_name defaults
# to the lowercase "cudly" (terraform/environments/aws/variables.tf).
# That resource-level tag overrides the provider's default_tags
# value of "CUDly" (uppercase) for the same key, so a
# case-sensitive StringEquals match against "CUDly" never
# matches the signing key and every action below was silently
# denied (AccessDenied: kms:ScheduleKeyDeletion) even though the
# key IS a CUDly-owned resource. See PR #1496.
Sid = "KMSMutateTaggedOnly"
Effect = "Allow"
Action = [
"kms:CancelKeyDeletion",
"kms:CreateAlias",
"kms:DeleteAlias",
"kms:DisableKey",
Expand All @@ -346,7 +365,7 @@ resource "aws_iam_policy" "compute" {
]
Resource = "*"
Condition = {
StringEquals = {
StringEqualsIgnoreCase = {
"aws:ResourceTag/Project" = "CUDly"
}
}
Expand Down
Loading