now using a boolean check for the sas keys rather than hard coding the environment (review)

Author: floormind

infrastructure/environments/review/variables.tfvars

@@ -1 +1,3 @@
 enable_gateway_test_vm   = true
+screening_entra_group_id = "14f915c3-ef0a-471b-b9bf-31187d18f8b6"
+enable_relay_sas_keys    = true

infrastructure/modules/arc-infra/outputs.tf

@@ -37,8 +37,8 @@ output "app_insights_connection_string" {
 output "relay_listen_sas_keys" {
   description = "Per-machine relay listen SAS primary keys, keyed by Arc resource name. Populated only for the review environment."
   sensitive   = true
-  value = var.enable_arc_servers && var.env_config == "review" ? {
+  value =  {
     for k, rule in azurerm_relay_hybrid_connection_authorization_rule.per_machine_listen :
     k => rule.primary_key
-  } : {}
+  }
 }

infrastructure/modules/arc-infra/relay.tf

@@ -51,7 +51,7 @@ resource "azurerm_relay_hybrid_connection_authorization_rule" "per_machine_liste
   for_each = {
     for machine_name, machine_config in local.arc_machines :
     machine_name => machine_config
-    if var.env_config == "review"
+    if var.enable_relay_sas_keys
   }
 
   name                   = "listen"

infrastructure/modules/arc-infra/variables.tf

@@ -28,3 +28,8 @@ variable "static_arc_machine_names" {
   type        = list(string)
   default     = []
 }
+
+variable "enable_relay_sas_keys" {
+  description = "Whether to create relay SAS keys for the Arc machines. Only used in the review environment."
+  type        = bool
+}

infrastructure/terraform/main.tf

@@ -11,6 +11,7 @@ module "arc_infra" {
   env_config               = var.env_config
   resource_group_name      = local.resource_group_name
   enable_arc_servers       = var.enable_arc_servers
+  enable_relay_sas_keys    = var.enable_relay_sas_keys
 
   # Create the HC for the test VM in the same run as VM creation.
   # The Arc data source won't see a machine registered in the same apply.

infrastructure/terraform/variables.tf

@@ -50,7 +50,13 @@ variable "gateway_test_vm_size" {
   default     = "Standard_B2s"
 }
 
+variable "enable_relay_sas_keys" {
+  description = "Whether to create relay SAS keys for the Arc machines"
+  default     = false
+  type        = bool
+}
+
 locals {
   region              = "uksouth"
   resource_group_name = "rg-${var.app_short_name}-${var.environment}-uks"
-}
+}

scripts/bash/deploy_arc_ring.sh

@@ -100,7 +100,8 @@ LOG_LEVEL=INFO
 SAMPLE_IMAGES_PATH=${BASE_PATH}/current/sample_images"
 
   if [[ -n "${RELAY_AUTH_BLOCK}" ]]; then
-    ENV_CONTENT="${ENV_CONTENT}${RELAY_AUTH_BLOCK}"
+    ENV_CONTENT="${ENV_CONTENT}
+${RELAY_AUTH_BLOCK}"
   fi
 
   # Cross-platform base64 encoding (works on macOS and Linux)