Merge pull request #164 from NHSDigital/DTOSS_Remove_per-HC_SAS_listen_keys

Remove relay SAS keys

Author: saliceti

docs/adr/ADR-005_Managed_Identity_For_Azure_Relay.md

@@ -16,16 +16,14 @@ The initial implementation used Shared Access Signature (SAS) tokens. These are
 
 As the gateway runs inside the hospital network but is provisioned via Azure Arc, it can be assigned a managed identity through Arc-enabled infrastructure. Storing a long-lived shared secret in the environment is therefore unnecessary operational overhead and a potential security risk.
 
-That said, setting up a working Relay connection locally is already complex. Mandating managed identity for all environments would add further friction for developers, who would need Azure CLI credentials with a Relay Listener role assignment before they could run the service.
 
 ## Decision
 
-In **production** (`ENVIRONMENT=prod`), the gateway uses `ManagedIdentityCredential` exclusively. The SAS token path is unavailable regardless of what environment variables are set. The gateway's managed identity must be assigned the **Azure Relay Listener** role on the hybrid connection resource in Azure.
+All the deployed environments use `ManagedIdentityCredential` exclusively, from both the web application side and the gateway. The gateway's managed identity must be assigned the **Azure Relay Listener** role on the hybrid connection resource in Azure.
 
-In **non-production** environments, the auth method is determined by whether `AZURE_RELAY_SHARED_ACCESS_KEY` is set:
+Developers need to connect to Azure relay but cannot use a managed identity. It is required to keep a relay with SAS keys enabled for their local testing. A SAS key may be provisioned and injected into `.env`.
 
-- If set, a SAS token is generated and embedded in the WebSocket URL (`sb-hc-token`), preserving the simpler local development setup.
-- If absent, `DefaultAzureCredential` is used, which works with Azure CLI credentials (`az login`) for developers who have the Listener role assigned to their identity.
+If no SAS key is present, `DefaultAzureCredential` is used for developer scenarios that rely on `az login` and the appropriate Relay Listener role assignment.
 
 The token is passed as an `Authorization: Bearer` HTTP header on the WebSocket upgrade request for managed identity paths. Azure Relay validates it against Azure AD.
 

infrastructure/modules/arc-infra/outputs.tf

@@ -33,12 +33,3 @@ output "app_insights_connection_string" {
   sensitive   = true
   value       = var.enable_arc_servers ? module.app_insights[0].connection_string : null
 }
-
-output "relay_listen_sas_keys" {
-  description = "Per-machine relay listen SAS primary keys, keyed by Arc resource name. Used by the deploy pipeline to write .env files."
-  sensitive   = true
-  value = var.enable_arc_servers ? {
-    for k, rule in azurerm_relay_hybrid_connection_authorization_rule.per_machine_listen :
-    k => rule.primary_key
-  } : {}
-}

infrastructure/modules/arc-infra/relay.tf

@@ -45,21 +45,6 @@ resource "azurerm_relay_hybrid_connection" "per_machine" {
   requires_client_authorization = true
 }
 
-# Listen-only SAS rule per HC — retained for local development / break-glass access.
-# Production relay authentication uses Managed Identity (see relay_listener_role below).
-resource "azurerm_relay_hybrid_connection_authorization_rule" "per_machine_listen" {
-  for_each = local.arc_machines
-
-  name                   = "listen"
-  hybrid_connection_name = azurerm_relay_hybrid_connection.per_machine[each.key].name
-  namespace_name         = local.relay_namespace_name
-  resource_group_name    = local.relay_namespace_rg
-
-  listen = true
-  send   = false
-  manage = false
-}
-
 # Look up each discovered Arc machine to obtain its system-assigned managed identity.
 # Static machines (registered in the same apply) are excluded — they are not yet
 # visible to the data source and will be picked up on the next apply after onboarding.

infrastructure/terraform/outputs.tf

@@ -8,9 +8,3 @@ output "relay_namespace_hostname" {
   description = "Relay namespace FQDN for AZURE_RELAY_NAMESPACE in the gateway .env"
   value       = module.arc_infra.relay_namespace_hostname
 }
-
-output "relay_listen_sas_keys" {
-  description = "Per-machine relay listen SAS primary keys, keyed by Arc resource name"
-  sensitive   = true
-  value       = module.arc_infra.relay_listen_sas_keys
-}