{"record":{"id":"8334a1356d14d582","repo":"microsoft/aspire","slug":"unknown-aws-credential-type-credential-gettype-name","errorCode":null,"errorMessage":"Unknown AWS credential type '{credential.GetType().Name}'.","messagePattern":"Unknown AWS credential type '(.+?)'\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Publishing/RadCredentialRegisterStep.cs","lineNumber":234,"sourceCode":"            $\"are shared across all environments, but environments {envNames} configure different {provider} \" +\n            \"credentials that would overwrite one another. Configure a single shared credential for all \" +\n            \"environments, or deploy them to separate Radius installations. Diagnostic: ASPIRERADIUS011.\");\n    }\n\n    private static string AzureCredentialIdentity(AzureRadiusCredential credential) => credential switch\n    {\n        AzureRadiusCredential.ServicePrincipal sp => $\"sp|{Canonicalize(sp.TenantId)}|{Canonicalize(sp.ClientId)}\",\n        AzureRadiusCredential.WorkloadIdentity wi => $\"wi|{Canonicalize(wi.TenantId)}|{Canonicalize(wi.ClientId)}\",\n        _ => throw new InvalidOperationException($\"Unknown Azure credential type '{credential.GetType().Name}'.\"),\n    };\n\n    private static string AwsCredentialIdentity(AwsRadiusCredential credential) => credential switch\n    {\n        // The access key id identifies the principal; it is bound via a parameter, so its\n        // resource name is used as a stable proxy without resolving the value here.\n        AwsRadiusCredential.AccessKey ak => $\"access-key|{ak.AccessKeyId.Resource.Name}\",\n        AwsRadiusCredential.Irsa irsa => $\"irsa|{irsa.IamRoleArn}\",\n        _ => throw new InvalidOperationException($\"Unknown AWS credential type '{credential.GetType().Name}'.\"),\n    };\n\n    // Inputs are validated as GUIDs before reaching here; normalize to the canonical \"D\"\n    // form so differing casing/formatting of the same GUID is not treated as a conflict.\n    private static string Canonicalize(string guid)\n        => Guid.TryParse(guid, out var parsed) ? parsed.ToString(\"D\") : guid;\n\n    private static async Task<string> ResolveParameterAsync(\n        IResourceBuilder<ParameterResource> parameter,\n        CancellationToken cancellationToken)\n    {\n        return await parameter.Resource.GetValueAsync(cancellationToken).ConfigureAwait(false) ?? string.Empty;\n    }\n\n    private static async Task RunRadAsync(\n        IReadOnlyList<string> args,\n        HashSet<string> secretFlags,\n        ILogger logger,","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Publishing/RadCredentialRegisterStep.cs#L216-L252","documentation":"While computing a stable identity for an AWS Radius credential (AccessKey or Irsa are the known shapes), any other AwsRadiusCredential subtype has no identity rule, so validation throws this InvalidOperationException as an exhaustiveness guard.","triggerScenarios":"Supplying a custom or version-mismatched subclass of AwsRadiusCredential to a Radius environment credential registration, then running the credential-conflict validation (ValidateNoConflictingInstallationCredentials).","commonSituations":"Mixed Aspire.Hosting.Radius package versions across a solution; a hand-written subclass of AwsRadiusCredential; refactoring that accidentally casts the wrong credential object into the AWS slot.","solutions":["Use only supported AWS credential kinds: AwsRadiusCredential.AccessKey or AwsRadiusCredential.Irsa.","Align package versions so the credential type comes from the same Aspire.Hosting.Radius version as the validator.","Report the unrecognized type name (from the message) to the Aspire maintainers if it is a shipped type."],"exampleFix":"// before\nvar credential = new MyCustomAwsRadiusCredential(accessKey, secretKey);\nenv.WithRadiusCredential(credential);\n\n// after\nvar credential = new AwsRadiusCredential.AccessKey(accessKeyIdParameter, secretAccessKeyParameter);\nenv.WithRadiusCredential(credential);","handlingStrategy":"type-guard","validationCode":"// Validate the credential kind before registering\nbool IsSupportedAwsCredential(AwsRadiusCredential c) =>\n    c is AwsRadiusCredential.AccessKey or AwsRadiusCredential.Irsa;\nif (!IsSupportedAwsCredential(credential)) throw new ArgumentException($\"Unsupported AWS credential type {credential.GetType().Name}\");","typeGuard":"var ok = credential is AwsRadiusCredential.AccessKey or AwsRadiusCredential.Irsa;","tryCatchPattern":"try { env.WithRadiusCredential(credential); }\ncatch (InvalidOperationException ex) when (ex.Message.StartsWith(\"Unknown AWS credential type\"))\n{\n    logger.LogError(ex, \"Credential type {Type} is not supported; use AccessKey or Irsa.\", credential.GetType().Name);\n}","preventionTips":["Only construct AwsRadiusCredential.AccessKey or AwsRadiusCredential.Irsa","Do not subclass AwsRadiusCredential","Align Aspire.Hosting.Radius package versions across projects"],"tags":["radius","aws","credentials","type-mismatch","validation"],"backgroundTag":"unsupported-enum-value","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}