{"record":{"id":"f81aaa175b621df5","repo":"microsoft/aspire","slug":"roles-i-is-not-a-valid-azurekeyvaultrole-value","errorCode":null,"errorMessage":"'{roles[i]}' is not a valid AzureKeyVaultRole value.","messagePattern":"'(.+?)' is not a valid AzureKeyVaultRole value\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultResourceExtensions.cs","lineNumber":223,"sourceCode":"        var builtInRoles = new KeyVaultBuiltInRole[roles.Length];\n        for (var i = 0; i < roles.Length; i++)\n        {\n            builtInRoles[i] = roles[i] switch\n            {\n                AzureKeyVaultRole.KeyVaultAdministrator => KeyVaultBuiltInRole.KeyVaultAdministrator,\n                AzureKeyVaultRole.KeyVaultCertificateUser => KeyVaultBuiltInRole.KeyVaultCertificateUser,\n                AzureKeyVaultRole.KeyVaultCertificatesOfficer => KeyVaultBuiltInRole.KeyVaultCertificatesOfficer,\n                AzureKeyVaultRole.KeyVaultContributor => KeyVaultBuiltInRole.KeyVaultContributor,\n                AzureKeyVaultRole.KeyVaultCryptoOfficer => KeyVaultBuiltInRole.KeyVaultCryptoOfficer,\n                AzureKeyVaultRole.KeyVaultCryptoServiceEncryptionUser => KeyVaultBuiltInRole.KeyVaultCryptoServiceEncryptionUser,\n                AzureKeyVaultRole.KeyVaultCryptoServiceReleaseUser => KeyVaultBuiltInRole.KeyVaultCryptoServiceReleaseUser,\n                AzureKeyVaultRole.KeyVaultCryptoUser => KeyVaultBuiltInRole.KeyVaultCryptoUser,\n                AzureKeyVaultRole.KeyVaultDataAccessAdministrator => KeyVaultBuiltInRole.KeyVaultDataAccessAdministrator,\n                AzureKeyVaultRole.KeyVaultReader => KeyVaultBuiltInRole.KeyVaultReader,\n                AzureKeyVaultRole.KeyVaultSecretsOfficer => KeyVaultBuiltInRole.KeyVaultSecretsOfficer,\n                AzureKeyVaultRole.KeyVaultSecretsUser => KeyVaultBuiltInRole.KeyVaultSecretsUser,\n                AzureKeyVaultRole.ManagedHsmContributor => KeyVaultBuiltInRole.ManagedHsmContributor,\n                _ => throw new ArgumentException($\"'{roles[i]}' is not a valid {nameof(AzureKeyVaultRole)} value.\", nameof(roles))\n            };\n        }\n\n        return builder.WithRoleAssignments(target, builtInRoles);\n    }\n\n    /// <summary>\n    /// Gets a secret reference for the specified secret name from the Azure Key Vault resource.\n    /// </summary>\n    /// <param name=\"builder\">The Azure Key Vault resource builder.</param>\n    /// <param name=\"secretName\">The name of the secret.</param>\n    /// <returns>A reference to the secret.</returns>\n    [AspireExport]\n    public static IAzureKeyVaultSecretReference GetSecret(this IResourceBuilder<AzureKeyVaultResource> builder, string secretName)\n    {\n        ArgumentNullException.ThrowIfNull(builder);\n\n        return builder.Resource.GetSecret(secretName);","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultResourceExtensions.cs#L205-L241","documentation":"WithRoleAssignments maps each AzureKeyVaultRole enum value to a KeyVaultBuiltInRole. The default arm of the switch expression throws ArgumentException when a role value in the supplied collection is not one of the known AzureKeyVaultRole members — typically from an invalid cast or an out-of-range enum value.","triggerScenarios":"Calling WithRoleAssignments on an Azure Key Vault resource builder passing a roles collection that contains an undefined or out-of-range AzureKeyVaultRole value, e.g. (AzureKeyVaultRole)999.","commonSituations":"Enum values obtained from configuration parsing, deserialization of stale saved models, or older/newer package versions where the enum gained or lost members.","solutions":["Use only defined AzureKeyVaultRole enum members (e.g. AzureKeyVaultRole.KeyVaultAdministrator, KeyVaultSecretsUser, etc.) in the roles collection.","Validate/parse roles with Enum.TryParse before passing them.","Check that all packages producing the enum values are the same version to avoid mismatched enum definitions."],"exampleFix":"// before\nvar roles = new[] { (AzureKeyVaultRole)int.Parse(config[\"role\"]) };\nvault.WithRoleAssignments(functionApp, roles);\n\n// after\nif (Enum.TryParse<AzureKeyVaultRole>(config[\"role\"], out var role))\n{\n    vault.WithRoleAssignments(functionApp, new[] { role });\n}","handlingStrategy":"validation","validationCode":"if (roles.Any(r => !Enum.IsDefined(r)))\n{\n    throw new ArgumentException(\"Roles contain undefined AzureKeyVaultRole values.\", nameof(roles));\n}","typeGuard":"bool IsDefinedRole(AzureKeyVaultRole r) => Enum.IsDefined(r);","tryCatchPattern":"try { vault.WithRoleAssignments(target, roles); }\ncatch (ArgumentException ex) when (ex.Message.Contains(\"AzureKeyVaultRole\")) { /* log and fix the role source */ }","preventionTips":["Parse roles with Enum.TryParse instead of casting ints.","Keep enum-producing packages on the same version across the solution.","Validate configuration-derived roles at startup."],"tags":["azure","key-vault","enum","role-assignments"],"backgroundTag":"invalid-enum-value","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}