{"record":{"id":"3d9722e55da28be8","repo":"microsoft/aspire","slug":"automatic-key-vault-generation-is-not-supported-in-this","errorCode":null,"errorMessage":"Automatic Key vault generation is not supported in this environment. Please create a key vault resource directly.","messagePattern":"Automatic Key vault generation is not supported in this environment\\. Please create a key vault resource directly\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.AppContainers/BaseContainerAppContext.cs","lineNumber":270,"sourceCode":"        if (value is ConnectionStringReference cs)\n        {\n            return ProcessValue(cs.Resource.ConnectionStringExpression, secretType: secretType, parent: parent);\n        }\n\n        if (value is IResourceWithConnectionString csrs)\n        {\n            return ProcessValue(csrs.ConnectionStringExpression, secretType: secretType, parent: parent);\n        }\n\n        if (value is BicepOutputReference output)\n        {\n            return (AllocateParameter(output, secretType: secretType), secretType);\n        }\n\n#pragma warning disable CS0618 // Type or member is obsolete\n        if (value is BicepSecretOutputReference)\n        {\n            throw new NotSupportedException(\"Automatic Key vault generation is not supported in this environment. Please create a key vault resource directly.\");\n        }\n#pragma warning restore CS0618 // Type or member is obsolete\n\n        if (value is IAzureKeyVaultSecretReference vaultSecretReference)\n        {\n            if (parent is null)\n            {\n                return (AllocateKeyVaultSecretUriReference(vaultSecretReference), SecretType.KeyVault);\n            }\n\n            return (AllocateParameter(vaultSecretReference, secretType: SecretType.KeyVault), SecretType.KeyVault);\n        }\n\n        if (value is EndpointReferenceExpression epExpr)\n        {\n            if (ComputeEnvironmentEndpointResolver.TryGetCrossEnvironmentEndpointExpression(\n                epExpr, [_containerAppEnvironmentContext.Environment], out var crossExpr))\n            {","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.AppContainers/BaseContainerAppContext.cs#L252-L288","documentation":"BaseContainerAppContext.ProcessValue throws this when a BicepSecretOutputReference (an obsolete type tied to automatic Key Vault generation) is used as a container app value. Aspire no longer auto-creates Key Vaults in this path; you must declare a Key Vault resource explicitly and reference its secrets. The type is marked [Obsolete] precisely because this path is unsupported.","triggerScenarios":"Passing a BicepSecretOutputReference (from the deprecated automatic Key Vault generation APIs) into WithEnvironment/WithArgs/WithEntrypoint on a container app or project resource.","commonSituations":"Older app models written before the automatic-keyvault-generation APIs were obsoleted being published to Container Apps; samples/code copied from pre-obsolescence documentation.","solutions":["Add an explicit AddAzureKeyVault resource and reference its secrets via IAzureKeyVaultSecretReference instead.","Replace the BicepSecretOutputReference with a plain string or environment-provided secret value.","Migrate off the obsolete automatic Key Vault generation APIs in the app model."],"exampleFix":"// before\n.WithEnvironment(\"CONN_SECRET\", bicepSecretOutputReference);\n\n// after\nvar kv = builder.AddAzureKeyVault(\"kv\");\n.WithEnvironment(\"CONN_SECRET\", kv.GetSecret(\"conn-string\"));","handlingStrategy":"validation","validationCode":"if (value is BicepSecretOutputReference)\n    throw new InvalidOperationException(\"Use an explicit AddAzureKeyVault resource and its GetSecret instead.\");","typeGuard":"bool IsObsoleteSecretRef(object? v) => v is BicepSecretOutputReference; // reject before publishing","tryCatchPattern":"try { /* build/publish */ } catch (NotSupportedException ex) when (ex.Message.Contains(\"Automatic Key vault generation\")) { /* migrate to explicit Key Vault resource */ }","preventionTips":["Never use BicepSecretOutputReference; it is obsolete and unsupported.","Declare Key Vaults with AddAzureKeyVault and reference secrets via GetSecret.","Enable obsolete-warning (CS0618) as error to catch legacy APIs at compile time."],"tags":["azure","container-apps","key-vault","deprecated-api","secrets"],"backgroundTag":"deprecated-api-usage","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}