Remove relay SAS keys

All deployed environments must use managed identities for security
reasons. For authenticating both the web application and the gateways.

Author: saliceti

infrastructure/modules/arc-infra/outputs.tf

@@ -33,12 +33,3 @@ output "app_insights_connection_string" {
   sensitive   = true
   value       = var.enable_arc_servers ? module.app_insights[0].connection_string : null
 }
-
-output "relay_listen_sas_keys" {
-  description = "Per-machine relay listen SAS primary keys, keyed by Arc resource name. Used by the deploy pipeline to write .env files."
-  sensitive   = true
-  value = var.enable_arc_servers ? {
-    for k, rule in azurerm_relay_hybrid_connection_authorization_rule.per_machine_listen :
-    k => rule.primary_key
-  } : {}
-}

infrastructure/modules/arc-infra/relay.tf

@@ -45,21 +45,6 @@ resource "azurerm_relay_hybrid_connection" "per_machine" {
   requires_client_authorization = true
 }
 
-# Listen-only SAS rule per HC — retained for local development / break-glass access.
-# Production relay authentication uses Managed Identity (see relay_listener_role below).
-resource "azurerm_relay_hybrid_connection_authorization_rule" "per_machine_listen" {
-  for_each = local.arc_machines
-
-  name                   = "listen"
-  hybrid_connection_name = azurerm_relay_hybrid_connection.per_machine[each.key].name
-  namespace_name         = local.relay_namespace_name
-  resource_group_name    = local.relay_namespace_rg
-
-  listen = true
-  send   = false
-  manage = false
-}
-
 # Look up each discovered Arc machine to obtain its system-assigned managed identity.
 # Static machines (registered in the same apply) are excluded — they are not yet
 # visible to the data source and will be picked up on the next apply after onboarding.

infrastructure/terraform/outputs.tf

@@ -8,9 +8,3 @@ output "relay_namespace_hostname" {
   description = "Relay namespace FQDN for AZURE_RELAY_NAMESPACE in the gateway .env"
   value       = module.arc_infra.relay_namespace_hostname
 }
-
-output "relay_listen_sas_keys" {
-  description = "Per-machine relay listen SAS primary keys, keyed by Arc resource name"
-  sensitive   = true
-  value       = module.arc_infra.relay_listen_sas_keys
-}