fix(iac/aws): case-insensitive tag match on kms:GetKeyPolicy deploy grant

[cristim]

What

Adversarial-review follow-up to #1496 and #1512 (OIDC signing-key RSA->ECC replace). Switches KMSReadTaggedOnly in policy_compute_b.tf from case-sensitive StringEquals "CUDly" to StringEqualsIgnoreCase.

Why

#1496 discovered that the OIDC signing key is tagged Project=cudly (lowercase): the tag comes from local.common_tags (Project = var.project_name, default "cudly"), which overrides the provider default_tags value "CUDly" for that resource. It fixed KMSMutateTaggedOnly (kms:ScheduleKeyDeletion etc.) to StringEqualsIgnoreCase accordingly.

KMSReadTaggedOnly gates the deploy role's only grant for kms:GetKeyPolicy on the same tag, but was left as case-sensitive StringEquals "CUDly", so by the identical reasoning it never matches the signing key. The AWS provider reads the key policy (kms:GetKeyPolicy) on every aws_kms_key refresh, so once both bootstrap policies are applied the deploy role hits AccessDenied: kms:GetKeyPolicy when refreshing/replacing the signing key, blocking the exact ECC replace #1496/#1512 exist to enable.

This was found by adversarially reviewing both merged PRs: the mutate path was fixed but the read path (GetKeyPolicy) carries the same latent case mismatch.

Confidence

• The case mismatch and the single-point GetKeyPolicy grant are confirmed by inspection (tag chain traced to local.common_tags -> var.project_name = "cudly"; GetKeyPolicy appears only in KMSReadTaggedOnly).
• The runtime "blocks the deploy" impact depends on the provider reading + hard-failing on GetKeyPolicy during aws_kms_key refresh (standard behaviour); precise fatality is best confirmed against live AWS. The fix is safe and internally consistent regardless.

Scope of the review (other probes)

• create_before_destroy on the key only (fix(iac/aws): create_before_destroy on OIDC signing key (follow-up to #1480) #1512): sound — the alias and IAM role-policy are updated in place (UpdateAlias / PutRolePolicy), not replaced, so no cycle and no need for CBD on them; new key is created and the alias repointed before the old key is scheduled for deletion.
• OIDC/JWKS continuity: the AWS signer caches the public key + kid via sync.Once with no invalidation, so warm Lambda containers can serve a stale JWKS during any signing-key replacement (transient verification mismatch until recycled). Pre-existing app-code behaviour, not introduced by these PRs, out of scope here.
• Tag-value: confirmed the signing key's Project tag is lowercase cudly.

Test

terraform validate passes on ci-cd-permissions.

Closes nothing; filed as a follow-up fix.

Summary by CodeRabbit

• Bug Fixes
  • Improved consistency when validating project tags during signing key policy operations, regardless of capitalization.
  • Added clarification around tag matching and key policy refresh behavior.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6ba2a486-c5ae-4537-8d1b-48d9c81d81a8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The compute_b KMS read policy now matches the Project resource tag case-insensitively when authorizing kms:GetKeyPolicy, with comments documenting the signing key policy behavior.

Changes

KMS tag policy

Layer / File(s)	Summary
Update KMS read condition terraform/environments/aws/ci-cd-permissions/policy_compute_b.tf	KMSReadTaggedOnly changes the Project tag condition from StringEquals to StringEqualsIgnoreCase and adds explanatory comments.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• LeanerCloud/CUDly#103: Modifies related KMS tag-based IAM condition logic.
• LeanerCloud/CUDly#525: Updates the same policy_compute_b.tf KMS tag condition area.
• LeanerCloud/CUDly#1496: Directly relates to case sensitivity in the same KMS policy condition.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: making the kms:GetKeyPolicy tag match case-insensitive for the deploy grant.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/kms-advrev-getkeypolicy-case

---

_{Comment @coderabbitai help to get the list of available commands.}