[#IEL-72] Fix policy for io-sign-backoffice-func keyvault on staging

[Civolo]

List of Changes

Fix policy for io-sign-backoffice-func keyvault on staging

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.

[changeset-bot]

⚠️ No Changeset found

Latest commit: b453fb6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

📋 Pre-commit Output Log

[INFO] Initializing environment for https://github.com/pagopa/dx.
[INFO] Initializing environment for https://github.com/antonbabenko/pre-commit-terraform.
Lock Terraform Registry modules......................(no files to check)Skipped

_{Generated on Mon Feb 9 15:26:12 UTC 2026
Run lock_modules on folder: infra/resources/prod/}

[github-actions]

📖 Terraform Plan (infra/resources/prod) - success

Show Plan

  # azurerm_key_vault_access_policy.backoffice_func_staging_slot_key_vault_access_policy will be created
  + resource "azurerm_key_vault_access_policy" "backoffice_func_staging_slot_key_vault_access_policy" {
      + certificate_permissions = []
      + id                      = (known after apply)
      + key_vault_id            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-sign-sec-rg/providers/Microsoft.KeyVault/vaults/io-p-sign-kv"
      + object_id               = "4c37efec-98f4-47dc-8ebb-5667f920c211"
      + secret_permissions      = [
          + "Get",
        ]
      + storage_permissions     = []
      + tenant_id               = "7788edaf-0346-4068-9d79-c868aed15b3d"
    }

  # module.io_platform_apim_api.azurerm_api_management_api_tag.io_sign_api_tag must be replaced
-/+ resource "azurerm_api_management_api_tag" "io_sign_api_tag" {
      ~ api_id = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-platform-api-gateway-apim-01/apis/io-p-sign-api" -> "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-platform-api-gateway-apim-01/apis/io-p-sign-api;rev=1" # forces replacement
      ~ id     = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-platform-api-gateway-apim-01/apis/io-p-sign-api/tags/IO-Sign" -> (known after apply)
        name   = "IO-Sign"
    }

Plan: 2 to add, 0 to change, 1 to destroy.

Warning: Argument is deprecated

  with module.cosmosdb_account.azurerm_cosmosdb_account.this,
  on .terraform/modules/cosmosdb_account/cosmosdb_account/main.tf line 7, in resource "azurerm_cosmosdb_account" "this":
   7:   enable_free_tier          = var.enable_free_tier

This property has been superseded by `free_tier_enabled` and will be removed
in v4.0 of the AzureRM Provider

(and 30 more similar warnings elsewhere)

Warning: Deprecated attribute

  on .terraform/modules/cosmosdb_account/cosmosdb_account/output.tf line 54, in output "connection_strings":
  54:   value     = azurerm_cosmosdb_account.this.connection_strings

The attribute "connection_strings" is deprecated. Refer to the provider
documentation for details.

(and one more similar warning elsewhere)