fix(iac/aws): create_before_destroy on OIDC signing key (follow-up to #1480)

[cristim]

Follow-up to #1480

#1480 migrated aws_kms_key.signing (OIDC issuer signing key) from RSA_2048 to ECC_NIST_P256 (ES256). KMS cannot change a key spec in place, so Terraform must replace the key.

Terraform's default destroy-before-create would ScheduleKeyDeletion on the live signing key (immediately unusable for kms:Sign) before the new EC key exists — briefly breaking OIDC client-assertion JWT minting (Azure AD federation) on deploy.

Change

Adds lifecycle { create_before_destroy = true } to aws_kms_key.signing so the new key is created and the alias cut over before the old key is scheduled for deletion. The alias updates in place (no replace), so it needs no change.

Scoped to AWS only: GCP crypto keys are versioned (algorithm change adds a version, no gap) and Azure Key Vault soft-delete keeps the old key recoverable.

terraform fmt + validate clean.

Refs #1480, #1496.

Summary by CodeRabbit

• Bug Fixes
  • Improved signing-key replacement behavior to help prevent temporary interruptions when keys are migrated.
  • Reduced the risk of failures in OIDC client-assertion JWT generation during signing-key updates.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 33 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 55b328ff-42f3-4567-bf7a-d844b3d36af6

📥 Commits

Reviewing files that changed from the base of the PR and between 2fb8e80 and b01b9d6.

📒 Files selected for processing (1)

• terraform/modules/compute/aws/lambda/signing-key.tf

📝 Walkthrough

Walkthrough

Terraform now creates a replacement signing KMS key before destroying the existing key by enabling create_before_destroy on aws_kms_key.signing.

Changes

KMS Signing Key Replacement

Layer / File(s)	Summary
Configure signing key replacement terraform/modules/compute/aws/lambda/signing-key.tf	The signing KMS key resource now uses a lifecycle rule with create_before_destroy = true.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• LeanerCloud/CUDly#1496: Updates deploy-role permissions for KMS key lifecycle and tagging operations associated with signing key replacement.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: enabling create_before_destroy on the OIDC signing key in AWS.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1480-signing-key-create-before-destroy

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cristim]

✅ Ready for human merge.

• CI: all checks green (rebased onto current main which carries the fix(frontend): resolve high-severity npm audit vulns reddening Security Scanning (#1510) #1511 npm-audit fix; the earlier Security Scanning / Snyk red was that shared pre-existing debt, not a regression in this one-line Terraform change).
• CodeRabbit: SUCCESS.
• Independent review (correct): adds lifecycle { create_before_destroy = true } to aws_kms_key.signing. A change that forces a new CMK (e.g. the fix(oidc): provision EC P-256 signing keys in Terraform to match ES256 code (follow-up to #882) #1480 RSA_2048 -> ECC_NIST_P256 migration) now creates the replacement key and repoints aws_kms_alias.signing to it (alias target updates in-place) BEFORE the old key is scheduled for deletion, closing the window where kms:Sign has no live key and OIDC client-assertion JWT minting would break. KMS keys have no name collision, so create-before-destroy is safe here.

Held for your merge (infra / security-adjacent).