{"record":{"id":"273d62ebb2444398","repo":"microsoft/aspire","slug":"cannot-create-the-cross-scope-acr-pull-identity-identityname","errorCode":null,"errorMessage":"Cannot create the cross-scope ACR pull identity '{identityName}' for environment '{builder.Resource.Name}' because a resource with that name already exists. Call 'WithAcrPullIdentity' on the environment to select an existing identity, or use a different resource name.","messagePattern":"Cannot create the cross-scope ACR pull identity '(.+?)' for environment '(.+?)' because a resource with that name already exists\\. Call 'WithAcrPullIdentity' on the environment to select an existing identity, or use a different resource name\\.","errorType":"exception","errorClass":"DistributedApplicationException","httpStatus":null,"severity":"error","filePath":"src/Shared/CrossScopeAcrPullIdentityPreparer.cs","lineNumber":122,"sourceCode":"        PipelineStepContext context,\n        IResourceBuilder<TEnvironment> builder,\n        Func<AzureUserAssignedIdentityResource, IAcrPullIdentityAnnotation> createIdentityAnnotation,\n        Action<IResourceBuilder<AzureUserAssignedIdentityResource>>? configureIdentity)\n        where TEnvironment : IResource, IAzureComputeEnvironmentResource\n    {\n        if (!ShouldPrepareIdentity(context.ExecutionContext, builder.Resource) ||\n            builder.Resource.ContainerRegistry is not AzureContainerRegistryResource registry)\n        {\n            return;\n        }\n\n        // A cross-scope role assignment cannot be emitted inline in the environment module (BCP139).\n        // Promote only this path to a standalone identity so AzureResourcePreparer can emit the\n        // role assignment as a module scoped to the existing registry.\n        var identityName = $\"{builder.Resource.Name}-mi\";\n        if (context.Model.Resources.TryGetByName(identityName, out _))\n        {\n            throw new DistributedApplicationException(\n                $\"Cannot create the cross-scope ACR pull identity '{identityName}' for environment '{builder.Resource.Name}' because a resource with that name already exists. Call 'WithAcrPullIdentity' on the environment to select an existing identity, or use a different resource name.\");\n        }\n\n        var identity = new AzureUserAssignedIdentityResource(identityName);\n        var identityBuilder = builder.ApplicationBuilder.CreateResourceBuilder(identity);\n        identityBuilder.ConfigureInfrastructure(infrastructure =>\n        {\n            // The inline identity uses the environment module's standard tags parameter. Recreate that\n            // contract on the promoted module so deployment tags and required-tag policies still apply.\n            var tags = new ProvisioningParameter(\"tags\", typeof(object))\n            {\n                Value = new BicepDictionary<string>()\n            };\n            infrastructure.Add(tags);\n\n            var identity = infrastructure.GetProvisionableResources().OfType<UserAssignedIdentity>().Single();\n            identity.Tags = tags;\n        });","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Shared/CrossScopeAcrPullIdentityPreparer.cs#L104-L140","documentation":"When WithCrossScopeAcrPullIdentity needs to synthesize a managed identity, it derives the name '{environmentName}-mi' and throws DistributedApplicationException if an Azure resource with that name already exists in the model, because a cross-scope role assignment (BCP139) requires promoting this path to a standalone identity resource. The throw prevents silently attaching to an unrelated resource that happens to share the name.","triggerScenarios":"Calling WithCrossScopeAcrPullIdentity on an environment when the app model already contains a resource named '{environment.Resource.Name}-mi' — typically a user-defined identity, another environment with the same name plus '-mi', or a manually created AzureUserAssignedIdentityResource with the colliding name.","commonSituations":"Two environments in one AppHost generate the same '-mi' suffix name; the developer already created an identity named e.g. 'env-mi' for other purposes; a previous version of the call already added the identity and the code now runs twice.","solutions":["Use WithAcrPullIdentity on the environment to reference the existing identity instead of creating a new one","Rename the existing colliding resource (e.g. the manually created identity) so it no longer matches '{envName}-mi'","Rename the environment resource itself so the derived '{name}-mi' is unique in the model","Check for duplicate calls to WithCrossScopeAcrPullIdentity on the same-named environment and remove the redundant one"],"exampleFix":"// before\nvar env = builder.AddAzureEnvironment(\"prod\");\nenv.WithCrossScopeAcrPullIdentity(); // throws if \"prod-mi\" already exists\n// after\nvar existing = builder.AddAzureUserAssignedIdentity(\"prod-mi\");\nenv.WithAcrPullIdentity(existing); // bind to the existing identity explicitly","handlingStrategy":"validation","validationCode":"var identityName = $\"{envBuilder.Resource.Name}-mi\";\nif (envBuilder.ApplicationBuilder.Resources.Any(r => string.Equals(r.Name, identityName, StringComparers.ResourceNameComparer)))\n{\n    // bind to the existing identity instead:\n    envBuilder.WithAcrPullIdentity(existingIdentity);\n}","typeGuard":null,"tryCatchPattern":"try { envBuilder.WithCrossScopeAcrPullIdentity(); }\ncatch (DistributedApplicationException ex) { throw new InvalidOperationException(\"Name collision on derived identity; use WithAcrPullIdentity with an existing identity.\", ex); }","preventionTips":["Grep the AppHost for resources named '{env}-mi' before adding cross-scope identities","Avoid naming custom identities with the '{environmentName}-mi' convention","Check for duplicate WithCrossScopeAcrPullIdentity calls on the same environment"],"tags":["azure","acr","naming-conflict","distributed-application"],"backgroundTag":"file-already-exists","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}