{"record":{"id":"b4805409827684a1","repo":"microsoft/aspire","slug":"az-resource-list-failed-exit-code-result-exitcode-result","errorCode":null,"errorMessage":"az resource list failed (exit code {result.ExitCode}): {result.StandardError}","messagePattern":"az resource list failed \\(exit code (.+?)\\): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs","lineNumber":909,"sourceCode":"    {\n        if (!string.IsNullOrEmpty(savedResourceGroup))\n        {\n            return savedResourceGroup;\n        }\n\n        // Keep the query scoped to the resolved subscription rather than the CLI default, otherwise\n        // a same-named cluster in the ambient subscription could be picked up instead.\n        logger.LogDebug(\n            \"Resource group not in deployment state, querying Azure for cluster '{ClusterName}'\",\n            clusterName);\n\n        var result = await runAzCommandAsync(\n            azPath,\n            BuildResourceGroupQueryArguments(subscriptionId, clusterName)).ConfigureAwait(false);\n\n        if (result.ExitCode != 0)\n        {\n            throw new InvalidOperationException(\n                $\"az resource list failed (exit code {result.ExitCode}): {result.StandardError}\");\n        }\n\n        // With '-o tsv' the query emits one resource group per matching cluster, newline separated:\n        //   my-rg\n        //   other-rg\n        // A cluster name is only unique within a resource group, not within a subscription, so the\n        // query can legitimately return several rows. Picking one would silently deploy into, and\n        // hand back credentials for, an unrelated cluster.\n        var resourceGroups = result.StandardOutput\n            .Split('\\n', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);\n\n        if (resourceGroups.Length == 0)\n        {\n            throw new InvalidOperationException(\n                $\"Could not resolve resource group for AKS cluster '{clusterName}'. \" +\n                \"Ensure Azure provisioning has completed.\");\n        }","sourceCodeStart":891,"sourceCodeEnd":927,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs#L891-L927","documentation":"To locate the resource group of an AKS cluster, the pipeline runs `az resource list` (via BuildResourceGroupQueryArguments) scoped to the subscription and cluster name. A non-zero exit code from the az CLI means the query itself failed - it did not just return no clusters - so Aspire surfaces the exit code and stderr verbatim.","triggerScenarios":"GetResourceGroupAsync invoked (via the resourceGroup property) when the `az` process exits non-zero: az CLI not authenticated, subscription not set/accessible, invalid arguments, network failure reaching Azure ARM endpoints, or az CLI version/extension errors.","commonSituations":"az not logged in (`az login` never run or token expired); the subscription was deleted or the principal lacks Reader on it; corporate proxy blocking ARM; using `az` from CI without a service principal configured.","solutions":["Run `az login` (or configure a service principal / managed identity) and confirm `az account show` points at the expected subscription.","Run the same `az resource list` query manually with the printed arguments to see the full error.","Verify network/proxy access to management.azure.com from the machine running the pipeline.","Update the az CLI (`az upgrade`) and extensions if stderr indicates extension or schema errors."],"exampleFix":"// before\naz resource list --query \"[...]\"   // fails: not logged in\n\n// after\naz login\naz account set --subscription 00000000-0000-0000-0000-000000000000\n// then rerun aspire deploy/destroy","handlingStrategy":"retry","validationCode":"var check = Process.Start(\"az\", \"account show\");\ncheck.WaitForExit();\nif (check.ExitCode != 0) throw new InvalidOperationException(\"az is not authenticated; run az login.\");","typeGuard":null,"tryCatchPattern":"try { await DeployAsync(); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"az resource list failed\"))\n{\n    // inspect exit code/stderr, re-authenticate with az login, then retry\n}","preventionTips":["Authenticate az before pipeline runs (az login or service principal)","Verify subscription access with az account show","Check proxy/firewall access to management.azure.com in CI"],"tags":["azure","aks","az-cli","process-failure"],"backgroundTag":"cli-command-failed","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}