identity: the key is sealed for attested runners; the control plane loses kms:Sign (I6)

[aledbf]

I6, with spin-stack/spin#286 (security zone: the user reviews).

• identity.tf. The identity key is no longer a SIGN_VERIFY key the control plane signs with. It becomes a symmetric key spin-identity that seals an ECDSA P-256 data key pair, which KMS makes for the control plane without its plaintext. The key policy:

  • lets the control plane only GenerateDataKeyPairWithoutPlaintext (P-256, in the identity's context);
  • lets the new identity-keys role Decrypt only with Recipient and the runner's PCR4/7/12;
  • denies Decrypt without attestation to everyone;
  • denies the control plane's role every way to open the key or make one it knows.

  The key is prevent_destroy and rotated.

• iam.tf.

  • SignItsWorkspacesIdentity is gone. The control plane's role has no KMS action of its own.
  • The control plane may assume the identity-keys role.
  • The runner's scope writes identity/issued/* and the CA, and reads rosters/*.

• boundary.tf. No role deletes a roster version, identity/issuer.json or identity/x509-ca.der: a delete marker over a roster is a member put back.

• config.tf. The document names identity = {key, role}.

• outputs.tf. identity_documents reads the public half from issuer.json.

• Tests. The posture test a_workspaces_identity_key_is_opened_only_by_an_attested_runner replaces the signing one. A planted P-384 pair spec fails it.

Order: merges with spin#286, and is applied once a spin release carries it: a control plane before #286 signs with KMS, and would find no kms:Sign.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}