[jmgasper]

Dev identity's authorization store still targets unencrypted Redis OSS 6.2.6 apicache. The Nest cache also supplies the legacy store option, which Nest cache manager v3 ignores. This change makes both use a shared REDIS_URL configuration, supports verified TLS through rediss://, and replaces the obsolete cache adapter with the supported Keyv Redis store.

REDIS_URL takes precedence over legacy host/port. TLS verifies certificates/hostnames and requires TLS 1.2 or later. The Nest cache checks connectivity at startup; authorization keys, JSON values, and the 90-day TTL are preserved. Cache-manager entries use millisecond TTLs and are now shared across tasks.

Dev preparation completed

• CloudFormation stack/replication group identity-api-v6-dev-cache: Valkey 9.1, one cache.t4g.micro, cluster mode disabled, encryption at rest, required TLS, and seven-day backups.
• Restored from pm-6691-apicache-20261109. A disposable VPC validation task verified TLS PING, synthetic write/read/TTL/delete, and plaintext rejection; 12 keys remained before/after.
• Created SecureString /config/identity-api-v6/appvar/REDIS_URL version 1 pointing to rediss://master.identity-api-v6-dev-cache.056cmt.use1.cache.amazonaws.com:6379.
• Staged its ECS secret binding in identity-api-v6:150, retaining the exact current image digest. The binding rollout completed with one healthy task and HTTP 200 from the public identity health check. That image ignores REDIS_URL and continues using the unchanged legacy host/port.
• Original cache/DNS remain available. Production and Keycloak are outside this change.

Deployment gate

Draft: do not merge until the final state check and cutover window are ready. Merging to develop deploys automatically. A restored snapshot does not replicate subsequent writes or revocations. Pause authorization mutations, verify/refresh the replacement state, drain old writers during deployment, then test the identity flows. Rolling back after new writes also requires reconciling state; simply returning to the old cache can resurrect revoked sessions.

See the migration runbook for cutover, validation, and rollback. Deleting the old cache is a later step.

Validation

• All PR checks pass: CircleCI build #206, CodeQL, and Trivy.

• 26 Redis configuration/auth-store unit tests pass.

• Disposable Redis integration: four plaintext cases and five TLS cases pass, including cross-instance sharing, millisecond expiry, authorization TTLs, unavailable-cache startup failure, and rejection of a wrong-hostname certificate by both clients.

• Authorization service/controller and email-change suites: 63 tests pass.

• Build, changed-file ESLint/Prettier, and five dependency compatibility tests pass.

• Broader checks have existing failures reproduced on unchanged develop: the same 19 auth-flow test failures, identical TypeScript diagnostics, and the same 6,723 repository-wide lint errors. No new diagnostics were introduced.

Tracks PM-6691.