Remove relay SAS keys by floormind · Pull Request #164 · NHSDigital/manage-breast-screening-gateway

floormind · 2026-07-15T08:37:44Z

Description

Remove Azure Relay SAS keys

All deployed environments now authenticate to Azure Relay using Managed Identity, so retaining SAS keys increases attack surface.

Jira link

https://nhsd-jira.digital.nhs.uk/browse/DTOSS-13123

Review notes

Review checklist

Check database queries are correctly scoped to current_provider

steventux

We're missing a description of the intent of this PR, also JIRA links help us track the changes.
I've suggested a couple of things for readability and formatting.

steventux

Could do with fixing up or deleting the wip commit. The SAS key descriptions refer to Arc machines which might be confusing.
Otheriwise looks good.

All deployed environments must use managed identities for security reasons. For authenticating both the web application and the gateways.

steventux

Looks good to me. One question about removing the listen hybrid connection.
It might be handy to have this in place on the review env only.

saliceti · 2026-07-30T14:20:02Z

As discussed with @steventux, these SAS keys were only created for the ARC registered gateways. These machines already use managed identities.
SAS keys are only required for local development, which relied on docker-compose. They are created manually and only the root key is typically used.

steventux

🔐

floormind requested review from carlosmartinez, mrlockstar and saliceti July 15, 2026 08:37

steventux reviewed Jul 16, 2026

View reviewed changes

Comment thread scripts/bash/deploy_arc_ring.sh Outdated

steventux reviewed Jul 16, 2026

View reviewed changes

Comment thread scripts/bash/deploy_arc_ring.sh Outdated

steventux reviewed Jul 16, 2026

View reviewed changes

floormind changed the title ~~adding changes for checking for SAS keys, this should only apply in r…~~ Checking SAS keys in review environment Jul 22, 2026

floormind added the deploy label Jul 23, 2026

floormind had a problem deploying to review July 23, 2026 07:51 — with GitHub Actions Failure

mrlockstar temporarily deployed to review July 23, 2026 08:54 — with GitHub Actions Inactive

mrlockstar temporarily deployed to review July 23, 2026 09:01 — with GitHub Actions Inactive

floormind had a problem deploying to github-pages July 23, 2026 14:51 — with GitHub Actions Failure

floormind temporarily deployed to review July 23, 2026 14:52 — with GitHub Actions Inactive

floormind temporarily deployed to review July 23, 2026 14:53 — with GitHub Actions Inactive

floormind temporarily deployed to review July 23, 2026 15:08 — with GitHub Actions Inactive

floormind had a problem deploying to review July 23, 2026 15:10 — with GitHub Actions Failure

floormind force-pushed the DTOSS_Remove_per-HC_SAS_listen_keys branch from 2a153d9 to b0278d7 Compare July 23, 2026 15:10

floormind temporarily deployed to review July 23, 2026 15:11 — with GitHub Actions Inactive

floormind temporarily deployed to review July 23, 2026 15:12 — with GitHub Actions Inactive

floormind temporarily deployed to review July 23, 2026 16:02 — with GitHub Actions Inactive

floormind temporarily deployed to review July 23, 2026 16:04 — with GitHub Actions Inactive

floormind temporarily deployed to review July 24, 2026 10:59 — with GitHub Actions Inactive

floormind temporarily deployed to review July 24, 2026 11:01 — with GitHub Actions Inactive

floormind temporarily deployed to review July 24, 2026 11:07 — with GitHub Actions Inactive

floormind temporarily deployed to review July 24, 2026 11:08 — with GitHub Actions Inactive

floormind had a problem deploying to review July 27, 2026 11:53 — with GitHub Actions Failure

floormind force-pushed the DTOSS_Remove_per-HC_SAS_listen_keys branch from 5ce20af to 55ebe46 Compare July 27, 2026 12:08

floormind had a problem deploying to review July 27, 2026 12:11 — with GitHub Actions Failure

floormind force-pushed the DTOSS_Remove_per-HC_SAS_listen_keys branch from 91c0c0a to b025d0c Compare July 27, 2026 12:34

floormind temporarily deployed to review July 27, 2026 12:35 — with GitHub Actions Inactive

floormind temporarily deployed to review July 27, 2026 12:37 — with GitHub Actions Inactive

floormind force-pushed the DTOSS_Remove_per-HC_SAS_listen_keys branch from b025d0c to 13ad7cb Compare July 28, 2026 15:53

floormind temporarily deployed to review July 28, 2026 15:55 — with GitHub Actions Inactive

floormind temporarily deployed to review July 28, 2026 15:57 — with GitHub Actions Inactive

steventux reviewed Jul 28, 2026

View reviewed changes

Comment thread infrastructure/modules/arc-infra/variables.tf Outdated

Comment thread infrastructure/terraform/variables.tf Outdated

saliceti changed the title ~~Checking SAS keys in review environment~~ Remove relay SAS keys Jul 29, 2026

saliceti had a problem deploying to review July 29, 2026 14:37 — with GitHub Actions Error

saliceti force-pushed the DTOSS_Remove_per-HC_SAS_listen_keys branch from 8bc20e0 to 1ea2923 Compare July 29, 2026 14:40

Remove relay SAS keys

fecb4e6

All deployed environments must use managed identities for security reasons. For authenticating both the web application and the gateways.

saliceti temporarily deployed to review July 29, 2026 14:42 — with GitHub Actions Inactive

Update ADR-005: remove SAS key authentication

e9d76d8

saliceti had a problem deploying to review July 29, 2026 14:44 — with GitHub Actions Error

saliceti force-pushed the DTOSS_Remove_per-HC_SAS_listen_keys branch from 8ab004e to e9d76d8 Compare July 29, 2026 14:44

saliceti temporarily deployed to review July 29, 2026 14:46 — with GitHub Actions Inactive

saliceti temporarily deployed to review July 29, 2026 14:48 — with GitHub Actions Inactive

steventux reviewed Jul 29, 2026

View reviewed changes

Comment thread infrastructure/modules/arc-infra/relay.tf

steventux previously approved these changes Jul 29, 2026

View reviewed changes

saliceti dismissed steventux’s stale review via b633708 July 30, 2026 09:29

saliceti temporarily deployed to review July 30, 2026 09:31 — with GitHub Actions Inactive

saliceti temporarily deployed to review July 30, 2026 09:32 — with GitHub Actions Inactive

saliceti force-pushed the DTOSS_Remove_per-HC_SAS_listen_keys branch from b633708 to e9d76d8 Compare July 30, 2026 14:13

saliceti temporarily deployed to review July 30, 2026 14:14 — with GitHub Actions Inactive

saliceti deployed to review July 30, 2026 14:16 — with GitHub Actions Active

steventux approved these changes Jul 30, 2026

View reviewed changes

saliceti merged commit 825dcd0 into main Jul 30, 2026
18 checks passed

saliceti deleted the DTOSS_Remove_per-HC_SAS_listen_keys branch July 30, 2026 14:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Remove relay SAS keys - #164

Remove relay SAS keys#164
saliceti merged 2 commits into
mainfrom
DTOSS_Remove_per-HC_SAS_listen_keys

floormind commented Jul 15, 2026 •

edited by saliceti

Loading

Uh oh!

Uh oh!

Uh oh!

steventux left a comment

Uh oh!

steventux left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

steventux left a comment

Uh oh!

saliceti commented Jul 30, 2026

Uh oh!

steventux left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

floormind commented Jul 15, 2026 • edited by saliceti Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Jira link

Review notes

Review checklist

Uh oh!

Uh oh!

Uh oh!

steventux left a comment

Choose a reason for hiding this comment

Uh oh!

steventux left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

steventux left a comment

Choose a reason for hiding this comment

Uh oh!

saliceti commented Jul 30, 2026

Uh oh!

steventux left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

floormind commented Jul 15, 2026 •

edited by saliceti

Loading