From fecb4e60f4ccc24a20024fd1b8371e60320d1611 Mon Sep 17 00:00:00 2001 From: Colin Saliceti <8416694+saliceti@users.noreply.github.com> Date: Wed, 29 Jul 2026 15:41:28 +0100 Subject: [PATCH 1/2] Remove relay SAS keys All deployed environments must use managed identities for security reasons. For authenticating both the web application and the gateways. --- infrastructure/modules/arc-infra/outputs.tf | 9 --------- infrastructure/modules/arc-infra/relay.tf | 15 --------------- infrastructure/terraform/outputs.tf | 6 ------ 3 files changed, 30 deletions(-) diff --git a/infrastructure/modules/arc-infra/outputs.tf b/infrastructure/modules/arc-infra/outputs.tf index 5030ce4f..d77bdd5d 100644 --- a/infrastructure/modules/arc-infra/outputs.tf +++ b/infrastructure/modules/arc-infra/outputs.tf @@ -33,12 +33,3 @@ output "app_insights_connection_string" { sensitive = true value = var.enable_arc_servers ? module.app_insights[0].connection_string : null } - -output "relay_listen_sas_keys" { - description = "Per-machine relay listen SAS primary keys, keyed by Arc resource name. Used by the deploy pipeline to write .env files." - sensitive = true - value = var.enable_arc_servers ? { - for k, rule in azurerm_relay_hybrid_connection_authorization_rule.per_machine_listen : - k => rule.primary_key - } : {} -} diff --git a/infrastructure/modules/arc-infra/relay.tf b/infrastructure/modules/arc-infra/relay.tf index db8a945f..27895161 100644 --- a/infrastructure/modules/arc-infra/relay.tf +++ b/infrastructure/modules/arc-infra/relay.tf @@ -45,21 +45,6 @@ resource "azurerm_relay_hybrid_connection" "per_machine" { requires_client_authorization = true } -# Listen-only SAS rule per HC — retained for local development / break-glass access. -# Production relay authentication uses Managed Identity (see relay_listener_role below). -resource "azurerm_relay_hybrid_connection_authorization_rule" "per_machine_listen" { - for_each = local.arc_machines - - name = "listen" - hybrid_connection_name = azurerm_relay_hybrid_connection.per_machine[each.key].name - namespace_name = local.relay_namespace_name - resource_group_name = local.relay_namespace_rg - - listen = true - send = false - manage = false -} - # Look up each discovered Arc machine to obtain its system-assigned managed identity. # Static machines (registered in the same apply) are excluded — they are not yet # visible to the data source and will be picked up on the next apply after onboarding. diff --git a/infrastructure/terraform/outputs.tf b/infrastructure/terraform/outputs.tf index b1142a91..d8029684 100644 --- a/infrastructure/terraform/outputs.tf +++ b/infrastructure/terraform/outputs.tf @@ -8,9 +8,3 @@ output "relay_namespace_hostname" { description = "Relay namespace FQDN for AZURE_RELAY_NAMESPACE in the gateway .env" value = module.arc_infra.relay_namespace_hostname } - -output "relay_listen_sas_keys" { - description = "Per-machine relay listen SAS primary keys, keyed by Arc resource name" - sensitive = true - value = module.arc_infra.relay_listen_sas_keys -} From e9d76d8e0590236c33657ec220e031d62a706841 Mon Sep 17 00:00:00 2001 From: Colin Saliceti <8416694+saliceti@users.noreply.github.com> Date: Wed, 29 Jul 2026 15:42:59 +0100 Subject: [PATCH 2/2] Update ADR-005: remove SAS key authentication --- docs/adr/ADR-005_Managed_Identity_For_Azure_Relay.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/docs/adr/ADR-005_Managed_Identity_For_Azure_Relay.md b/docs/adr/ADR-005_Managed_Identity_For_Azure_Relay.md index 8fd1181a..940165d4 100644 --- a/docs/adr/ADR-005_Managed_Identity_For_Azure_Relay.md +++ b/docs/adr/ADR-005_Managed_Identity_For_Azure_Relay.md @@ -16,16 +16,14 @@ The initial implementation used Shared Access Signature (SAS) tokens. These are As the gateway runs inside the hospital network but is provisioned via Azure Arc, it can be assigned a managed identity through Arc-enabled infrastructure. Storing a long-lived shared secret in the environment is therefore unnecessary operational overhead and a potential security risk. -That said, setting up a working Relay connection locally is already complex. Mandating managed identity for all environments would add further friction for developers, who would need Azure CLI credentials with a Relay Listener role assignment before they could run the service. ## Decision -In **production** (`ENVIRONMENT=prod`), the gateway uses `ManagedIdentityCredential` exclusively. The SAS token path is unavailable regardless of what environment variables are set. The gateway's managed identity must be assigned the **Azure Relay Listener** role on the hybrid connection resource in Azure. +All the deployed environments use `ManagedIdentityCredential` exclusively, from both the web application side and the gateway. The gateway's managed identity must be assigned the **Azure Relay Listener** role on the hybrid connection resource in Azure. -In **non-production** environments, the auth method is determined by whether `AZURE_RELAY_SHARED_ACCESS_KEY` is set: +Developers need to connect to Azure relay but cannot use a managed identity. It is required to keep a relay with SAS keys enabled for their local testing. A SAS key may be provisioned and injected into `.env`. -- If set, a SAS token is generated and embedded in the WebSocket URL (`sb-hc-token`), preserving the simpler local development setup. -- If absent, `DefaultAzureCredential` is used, which works with Azure CLI credentials (`az login`) for developers who have the Listener role assigned to their identity. +If no SAS key is present, `DefaultAzureCredential` is used for developer scenarios that rely on `az login` and the appropriate Relay Listener role assignment. The token is passed as an `Authorization: Bearer` HTTP header on the WebSocket upgrade request for managed identity paths. Azure Relay validates it against Azure AD.