terraform-aws-signing-kms¶

A small, focused OpenTofu / Terraform module that provisions an AWS KMS asymmetric signing key plus an IAM role assumable from an external OIDC IDP (default: GitLab.com). Built for release-binary signing chains where:

• The private key never leaves AWS KMS.
• No human and no long-lived credential can sign — only the CI job whose OIDC sub claim matches a caller-supplied pattern.
• The apply role that manages the infrastructure cannot mint signatures, even on a full compromise of the apply runner.

Sibling to terraform-aws-bootstrap (state backend + OIDC IDP) and terraform-aws-security-baseline (account hardening + operator role). This module composes after both.

Start here¶

• Quick start — one-call usage in the README.
• v0.1 design spec — scope decisions, the permission-class split, and rejected alternatives.
• Engineering standards — module conventions, the tag-propagation rule, naming, security defaults.

Related projects¶

• phpboyscout/infra — the first user of this module: provisions the gtb-release-signing-v1 key for phpboyscout/go-tool-base's Phase 2 signed-update pipeline.
• go-tool-base — the consuming tool, whose Phase 2 signing prep document describes the wider trust model the AWS half implements.

Further reading¶

The blog carries a curated route through this subject: Infrastructure with AWS and OpenTofu collects everything written about it, ordered so you can start at the beginning rather than newest-first.