keys

Author: saliceti

infrastructure/modules/arc-infra/relay.tf

@@ -45,6 +45,25 @@ resource "azurerm_relay_hybrid_connection" "per_machine" {
   requires_client_authorization = true
 }
 
+# Listen-only SAS rule per HC — retained for local development / break-glass access.
+# Production relay authentication uses Managed Identity (see relay_listener_role below).
+resource "azurerm_relay_hybrid_connection_authorization_rule" "per_machine_listen" {
+  for_each = {
+    for machine_name, machine_config in local.arc_machines :
+    machine_name => machine_config
+    if var.enable_relay_sas_keys
+  }
+
+  name                   = "listen"
+  hybrid_connection_name = azurerm_relay_hybrid_connection.per_machine[each.key].name
+  namespace_name         = local.relay_namespace_name
+  resource_group_name    = local.relay_namespace_rg
+
+  listen = true
+  send   = false
+  manage = false
+}
+
 # Look up each discovered Arc machine to obtain its system-assigned managed identity.
 # Static machines (registered in the same apply) are excluded — they are not yet
 # visible to the data source and will be picked up on the next apply after onboarding.

infrastructure/modules/arc-infra/variables.tf

@@ -28,3 +28,8 @@ variable "static_arc_machine_names" {
   type        = list(string)
   default     = []
 }
+
+variable "enable_relay_sas_keys" {
+  description = "Whether to create relay SAS keys for the Arc machines. Only used in the review environment."
+  type        = bool
+}

infrastructure/terraform/main.tf

@@ -11,6 +11,7 @@ module "arc_infra" {
   env_config               = var.env_config
   resource_group_name      = local.resource_group_name
   enable_arc_servers       = var.enable_arc_servers
+  enable_relay_sas_keys    = var.enable_relay_sas_keys
 
   # Create the HC for the test VM in the same run as VM creation.
   # The Arc data source won't see a machine registered in the same apply.

infrastructure/terraform/variables.tf

@@ -50,7 +50,13 @@ variable "gateway_test_vm_size" {
   default     = "Standard_B2s"
 }
 
+variable "enable_relay_sas_keys" {
+  description = "Whether to create relay SAS keys for the Arc machines"
+  default     = false
+  type        = bool
+}
+
 locals {
   region              = "uksouth"
   resource_group_name = "rg-${var.app_short_name}-${var.environment}-uks"
-}
+}