wip

Author: saliceti

docs/adr/ADR-005_Managed_Identity_For_Azure_Relay.md

@@ -16,17 +16,14 @@ The initial implementation used Shared Access Signature (SAS) tokens. These are
 
 As the gateway runs inside the hospital network but is provisioned via Azure Arc, it can be assigned a managed identity through Arc-enabled infrastructure. Storing a long-lived shared secret in the environment is therefore unnecessary operational overhead and a potential security risk.
 
-That said, setting up a working Relay connection locally is already complex. Mandating managed identity for all environments would add further friction for developers, who would need Azure CLI credentials with a Relay Listener role assignment before they could run the service.
 
 ## Decision
 
-In **production** (`ENVIRONMENT=prod`), the gateway uses `ManagedIdentityCredential` exclusively. The SAS token path is unavailable regardless of what environment variables are set. The gateway's managed identity must be assigned the **Azure Relay Listener** role on the hybrid connection resource in Azure.
+All the deployed environments use `ManagedIdentityCredential` exclusively, from both the web application side and the gateway. The gateway's managed identity must be assigned the **Azure Relay Listener** role on the hybrid connection resource in Azure.
 
-In **non-production** environments, SAS-based authentication is only enabled in the review environment
+Developers need to connect to Azure relay but cannot use a managed identity. It is required to keep relay with SAS keys enabled for their local testing. A SAS key may be provisioned and injected into `.env`.
 
-- In the review environment, a SAS key may be provisioned and injected into `.env` so local testing against the gateway test VM continues to work.
-- In dev, preprod, and prod the relay listener uses managed identity / Azure AD authentication and no SAS key is provisioned or injected into `.env`.
-- If no SAS key is present, `DefaultAzureCredential` is used for developer scenarios that rely on `az login` and the appropriate Relay Listener role assignment.
+If no SAS key is present, `DefaultAzureCredential` is used for developer scenarios that rely on `az login` and the appropriate Relay Listener role assignment.
 
 The token is passed as an `Authorization: Bearer` HTTP header on the WebSocket upgrade request for managed identity paths. Azure Relay validates it against Azure AD.
 

docs/relay-listener/README.md

@@ -3,8 +3,6 @@
 Relay listener uses websocket communication to Manage Breast Screening service via Azure Relay.
 The listener processes worklist actions sent from Manage/Django and creates worklist items in the Modality Worklist server.
 
-Note: SAS-based relay authentication is review-only. For dev, preprod, and prod, the listener should use managed identity and no `AZURE_RELAY_SHARED_ACCESS_KEY` should be injected into `.env`.
-
 ## Architecture
 
 ```

infrastructure/environments/review/variables.tfvars

@@ -1,3 +1,2 @@
 enable_gateway_test_vm   = true
 screening_entra_group_id = "14f915c3-ef0a-471b-b9bf-31187d18f8b6"
-enable_relay_sas_keys    = false

infrastructure/modules/arc-infra/outputs.tf

@@ -33,12 +33,3 @@ output "app_insights_connection_string" {
   sensitive   = true
   value       = var.enable_arc_servers ? module.app_insights[0].connection_string : null
 }
-
-output "relay_listen_sas_keys" {
-  description = "Per-machine relay listen SAS primary keys, keyed by Arc resource name. Populated only for the review environment."
-  sensitive   = true
-  value =  {
-    for k, rule in azurerm_relay_hybrid_connection_authorization_rule.per_machine_listen :
-    k => rule.primary_key
-  }
-}

infrastructure/modules/arc-infra/relay.tf

@@ -45,25 +45,6 @@ resource "azurerm_relay_hybrid_connection" "per_machine" {
   requires_client_authorization = true
 }
 
-# Listen-only SAS rule per HC — retained for local development / break-glass access.
-# Production relay authentication uses Managed Identity (see relay_listener_role below).
-resource "azurerm_relay_hybrid_connection_authorization_rule" "per_machine_listen" {
-  for_each = {
-    for machine_name, machine_config in local.arc_machines :
-    machine_name => machine_config
-    if var.enable_relay_sas_keys
-  }
-
-  name                   = "listen"
-  hybrid_connection_name = azurerm_relay_hybrid_connection.per_machine[each.key].name
-  namespace_name         = local.relay_namespace_name
-  resource_group_name    = local.relay_namespace_rg
-
-  listen = true
-  send   = false
-  manage = false
-}
-
 # Look up each discovered Arc machine to obtain its system-assigned managed identity.
 # Static machines (registered in the same apply) are excluded — they are not yet
 # visible to the data source and will be picked up on the next apply after onboarding.

infrastructure/modules/arc-infra/variables.tf

@@ -28,8 +28,3 @@ variable "static_arc_machine_names" {
   type        = list(string)
   default     = []
 }
-
-variable "enable_relay_sas_keys" {
-  description = "Whether to create relay SAS keys for the Arc machines. Only used in the review environment."
-  type        = bool
-}

infrastructure/terraform/main.tf

@@ -11,7 +11,6 @@ module "arc_infra" {
   env_config               = var.env_config
   resource_group_name      = local.resource_group_name
   enable_arc_servers       = var.enable_arc_servers
-  enable_relay_sas_keys    = var.enable_relay_sas_keys
 
   # Create the HC for the test VM in the same run as VM creation.
   # The Arc data source won't see a machine registered in the same apply.

infrastructure/terraform/outputs.tf

@@ -8,9 +8,3 @@ output "relay_namespace_hostname" {
   description = "Relay namespace FQDN for AZURE_RELAY_NAMESPACE in the gateway .env"
   value       = module.arc_infra.relay_namespace_hostname
 }
-
-output "relay_listen_sas_keys" {
-  description = "Per-machine relay listen SAS primary keys, keyed by Arc resource name"
-  sensitive   = true
-  value       = module.arc_infra.relay_listen_sas_keys
-}

infrastructure/terraform/variables.tf

@@ -50,13 +50,8 @@ variable "gateway_test_vm_size" {
   default     = "Standard_B2s"
 }
 
-variable "enable_relay_sas_keys" {
-  description = "Whether to create relay SAS keys for the Arc machines"
-  default     = false
-  type        = bool
-}
 
 locals {
   region              = "uksouth"
   resource_group_name = "rg-${var.app_short_name}-${var.environment}-uks"
-}
+}