{"record":{"id":"7429303303d0abf1","repo":"microsoft/aspire","slug":"secret-secretname-not-found-in-key-vault","errorCode":null,"errorMessage":"Secret '{secretName}' not found in Key Vault '{azureKeyVaultResource.Name}'.","messagePattern":"Secret '(.+?)' not found in Key Vault '(.+?)'\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultSecretReference.cs","lineNumber":39,"sourceCode":"    /// Gets the Azure Key Vault resource.\n    /// </summary>\n    public IAzureKeyVaultResource Resource => azureKeyVaultResource;\n\n    /// <summary>\n    /// Gets or sets the resource that writes this secret to the Key Vault.\n    /// </summary>\n    public IResource? SecretOwner { get; set; }\n\n    string IManifestExpressionProvider.ValueExpression => $\"{{{azureKeyVaultResource.Name}.secrets.{SecretName}}}\";\n\n    async ValueTask<string?> IValueProvider.GetValueAsync(CancellationToken cancellationToken)\n    {\n        if (azureKeyVaultResource.SecretResolver is { } secretResolver)\n        {\n            return await secretResolver(this, cancellationToken).ConfigureAwait(false);\n        }\n\n        throw new InvalidOperationException($\"Secret '{secretName}' not found in Key Vault '{azureKeyVaultResource.Name}'.\");\n    }\n}\n","sourceCodeStart":21,"sourceCodeEnd":42,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultSecretReference.cs#L21-L42","documentation":"Resolving a secret's value via GetValueAsync requires a SecretResolver to have been registered on the AzureKeyVaultResource (typically wired when the app actually runs against the vault). If no resolver is set, the reference cannot be resolved and this InvalidOperationException is thrown naming the secret and vault.","triggerScenarios":"Calling IAzureKeyVaultSecretReference.GetValueAsync when the AzureKeyVaultResource.SecretResolver is null — e.g. in publish/manifest mode, in unit tests constructing the reference manually, or before the vault resource's client factory has been configured.","commonSituations":"Running or testing code that resolves secrets without a live Azure environment, using the secret reference outside the distributed application runtime, or mocking the vault resource without setting SecretResolver.","solutions":["Ensure the application is running in run mode with proper Azure credentials so the SecretResolver is registered on the vault resource.","In tests, set azureKeyVaultResource.SecretResolver to a test delegate returning the expected value.","Do not resolve secret values at publish/manifest time; resolve them only in the running app or from IConfiguration.","Verify the secret actually exists in the vault if a custom resolver filters by existence."],"exampleFix":"// before (test)\nvar value = await secretReference.GetValueAsync(ct);\n\n// after (test)\nvaultResource.SecretResolver = (r, ct) => ValueTask.FromResult(\"test-secret\");\nvar value = await secretReference.GetValueAsync(ct);","handlingStrategy":"try-catch","validationCode":"if (azureKeyVaultResource.SecretResolver is null)\n{\n    throw new InvalidOperationException(\"No secret resolver registered; secret values can only be resolved while the app is running against the vault.\");\n}","typeGuard":null,"tryCatchPattern":"try { var value = await secretRef.GetValueAsync(ct); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"not found in Key Vault\")) { /* fall back to config or fail with a clear message */ }","preventionTips":["Resolve secret values only inside the running distributed application, not at publish/manifest time.","In tests, always set SecretResolver on the vault resource before resolving.","Verify the secret exists in the target vault before referencing it."],"tags":["azure","key-vault","secrets","resolver"],"backgroundTag":"resource-not-found","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}