{"record":{"id":"0df2cb0c5ce74678","repo":"microsoft/aspire","slug":"value-must-be-a-parameter-resource-builder-or-reference","errorCode":null,"errorMessage":"Value must be a parameter resource builder or reference expression.","messagePattern":"Value must be a parameter resource builder or reference expression\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultResourceExtensions.cs","lineNumber":279,"sourceCode":"    /// Adds a secret to the Azure Key Vault\n    /// </summary>\n    [AspireExport(\"addSecret\")]\n    internal static IResourceBuilder<AzureKeyVaultSecretResource> AddSecretForPolyglot(\n        this IResourceBuilder<AzureKeyVaultResource> builder,\n        [ResourceName] string name,\n        [AspireUnion(typeof(IResourceBuilder<ParameterResource>), typeof(ReferenceExpression))] object value,\n        string? secretName = null)\n    {\n        ArgumentNullException.ThrowIfNull(builder);\n        ArgumentNullException.ThrowIfNull(value);\n\n        secretName ??= name;\n\n        return value switch\n        {\n            IResourceBuilder<ParameterResource> parameterResource => builder.AddSecret(name, secretName, parameterResource),\n            ReferenceExpression expression => builder.AddSecret(name, secretName, expression),\n            _ => throw new ArgumentException(\"Value must be a parameter resource builder or reference expression.\", nameof(value))\n        };\n    }\n\n    /// <summary>\n    /// Adds a secret to the Azure Key Vault resource with the value from a parameter resource.\n    /// </summary>\n    /// <param name=\"builder\">The Azure Key Vault resource builder.</param>\n    /// <param name=\"name\">The name of the secret. Must follow Azure Key Vault naming rules.</param>\n    /// <param name=\"parameterResource\">The parameter resource containing the secret value.</param>\n    /// <returns>A reference to the <see cref=\"IResourceBuilder{T}\"/>.</returns>\n    [AspireExportIgnore(Reason = \"Raw ParameterResource overload; use the IResourceBuilder<ParameterResource> variant instead.\")]\n    public static IResourceBuilder<AzureKeyVaultSecretResource> AddSecret(this IResourceBuilder<AzureKeyVaultResource> builder, string name, ParameterResource parameterResource)\n    {\n        ArgumentNullException.ThrowIfNull(builder);\n        ArgumentNullException.ThrowIfNull(parameterResource);\n\n        ValidateSecretName(name);\n","sourceCodeStart":261,"sourceCodeEnd":297,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultResourceExtensions.cs#L261-L297","documentation":"This AddSecret overload accepts only two shapes for the secret value: a parameter resource builder (IResourceBuilder<ParameterResource>) or a ReferenceExpression. Any other object type fails the switch and throws ArgumentException naming the 'value' parameter.","triggerScenarios":"Calling the polyglot AddSecret API passing something other than IResourceBuilder<ParameterResource> or ReferenceExpression — e.g. a raw string, an IResourceBuilder of another resource type, or a plain object.","commonSituations":"Developers assume strings or other resource builders are accepted for secret values; confusion between the several AddSecret overloads available on the Key Vault resource.","solutions":["Convert the value to a ReferenceExpression via ReferenceExpression.Create(...) and pass that.","Wrap the value in a parameter resource: builder.AddParameter(name, value, secret: true), then pass that builder.","Check the available AddSecret overloads and pick the one matching the value type you actually have."],"exampleFix":"// before\nkv.AddSecretForPolyglot(\"connStr\", someString);\n\n// after\nvar expr = ReferenceExpression.Create($\"{someParameter}\");\nkv.AddSecretForPolyglot(\"connStr\", expr);","handlingStrategy":"type-guard","validationCode":"if (value is not (IResourceBuilder<ParameterResource> or ReferenceExpression))\n{\n    throw new ArgumentException(\"Value must be a parameter resource builder or reference expression.\", nameof(value));\n}","typeGuard":"bool IsAcceptableSecretValue(object v) => v is IResourceBuilder<ParameterResource> or ReferenceExpression;","tryCatchPattern":"try { kv.AddSecretForPolyglot(name, value); }\ncatch (ArgumentException ex) when (ex.ParamName == \"value\") { /* wrap value in ReferenceExpression and retry */ }","preventionTips":["Check the AddSecret overload signatures before calling.","Normalize all secret values through a single helper that produces ReferenceExpression.","Avoid passing raw strings or other resource builders to this API."],"tags":["azure","key-vault","argument","secrets"],"backgroundTag":"invalid-argument-value","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}