{"record":{"id":"9933a9834fabe6bd","repo":"microsoft/aspire","slug":"existing-connector-connection-builder-resource-name-is-read","errorCode":null,"errorMessage":"Existing connector connection '{builder.Resource.Name}' is read-only and cannot create an access policy.","messagePattern":"Existing connector connection '(.+?)' is read-only and cannot create an access policy\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.ConnectorNamespace/AzureConnectorNamespaceExtensions.cs","lineNumber":393,"sourceCode":"    [AspireExport]\n    public static IResourceBuilder<AzureConnectorNamespaceConnectionResource> WithAccessPolicy(\n        this IResourceBuilder<AzureConnectorNamespaceConnectionResource> builder,\n        [ResourceName] string name,\n        AzureConnectorNamespaceAccessPolicyOptions options)\n    {\n        ArgumentNullException.ThrowIfNull(builder);\n        ArgumentException.ThrowIfNullOrWhiteSpace(name);\n        ArgumentNullException.ThrowIfNull(options);\n        ValidateEntraPrincipalIds(\n            options.ObjectId,\n            options.TenantId,\n            \"connection access policy\",\n            nameof(options.ObjectId),\n            nameof(options.TenantId),\n            nameof(options));\n        if (builder.Resource.IsExisting)\n        {\n            throw new InvalidOperationException(\n                $\"Existing connector connection '{builder.Resource.Name}' is read-only and cannot create an access policy.\");\n        }\n\n        var policyName = options.PolicyName ?? name;\n        ValidateConnectorResourceName(policyName, nameof(options));\n        var resourceName = GetValidatedAccessPolicyResourceName(builder.Resource, name, policyName);\n\n        builder.Resource.AccessPolicies.Add(new AzureConnectorNamespaceConnectionAccessPolicyResource(\n            resourceName,\n            policyName,\n            builder.Resource,\n            options.ObjectId,\n            options.TenantId));\n        return builder;\n    }\n\n    /// <summary>\n    /// Adds a connection access policy for a user-assigned managed identity.","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.ConnectorNamespace/AzureConnectorNamespaceExtensions.cs#L375-L411","documentation":"WithAccessPolicy on an Azure Connector Namespace connection refuses to add an access policy when the underlying resource was declared as existing (AsExisting). Existing references are read-only pointers to infrastructure Aspire does not own, so it cannot create or mutate access policies on them. The library throws early at model-build time rather than failing during deployment.","triggerScenarios":"Calling WithAccessPolicy(...) on an IResourceBuilder for a connector connection whose resource has IsExisting == true, i.e. after calling .AsExisting() (or constructing the resource as an existing reference).","commonSituations":"Pointing an app at a pre-provisioned connector connection with AsExisting and then trying to attach an access policy for a compute resource; copying fluent-modeling code that was written for newly-created connections onto an existing-reference builder.","solutions":["Remove the WithAccessPolicy call and manage the access policy on the existing connection directly in Azure (portal/CLI/Bicep).","If you truly need code-managed access policies, create the connector connection in the app model instead of marking it AsExisting.","Guard the call: only invoke WithAccessPolicy when builder.Resource.IsExisting is false, or skip it conditionally for existing resources."],"exampleFix":"// before\nvar connection = azure.AddConnectorConnection(\"existing-conn\").AsExisting();\nconnection.WithAccessPolicy(\"app-policy\", policyOptions); // throws\n\n// after\nvar connection = azure.AddConnectorConnection(\"existing-conn\").AsExisting();\n// Manage the access policy for the existing connection outside Aspire;\n// reference it without WithAccessPolicy.","handlingStrategy":"validation","validationCode":"if (builder.Resource.IsExisting)\n{\n    // manage the access policy out-of-band instead of calling WithAccessPolicy\n}\nelse\n{\n    connection.WithAccessPolicy(\"app-policy\", policyOptions);\n}","typeGuard":null,"tryCatchPattern":"try\n{\n    connection.WithAccessPolicy(\"app-policy\", policyOptions);\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"is read-only\"))\n{\n    // fall back to out-of-band policy management for existing connections\n}","preventionTips":["Treat AsExisting resources as read-only: never chain child-resource APIs (policies, connectors) on them.","Decide create-vs-existing mode at the top of your AppHost before adding child resources.","Search your AppHost for AsExisting() and audit that no WithAccessPolicy/WithConnector calls follow."],"tags":["azure","aspire-hosting","access-policy","invalid-state-transition"],"backgroundTag":"invalid-state-transition","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}