microsoft/aspire · error · ArgumentException

An access rule named

Error message

An access rule named '{rule.Name}' already exists in Network Security Perimeter '{builder.Resource.Name}'.

What it means

WithAccessRule adds an access rule to an Azure Network Security Perimeter resource. Duplicate rule names (compared case-insensitively) are rejected with ArgumentException because access rules must be uniquely named within the perimeter.

Solutions

1. Give each access rule a unique name within the perimeter.
2. Make rule names distinctive by including the target resource or purpose, e.g. $"{target.Name}-access".
3. Audit helper/config code for repeated fixed rule names.
4. Check existing rules via nsp.Resource.AccessRules before adding dynamically named rules.

Example fix

// before
nsp.WithAccessRule(new NspAccessRule { Name = "allow-storage", ... });
nsp.WithAccessRule(new NspAccessRule { Name = "Allow-Storage", ... });
// after
nsp.WithAccessRule(new NspAccessRule { Name = "allow-storage", ... });
nsp.WithAccessRule(new NspAccessRule { Name = "allow-keyvault", ... });

if (builder.Resource.AccessRules.Any(r => string.Equals(r.Name, rule.Name, StringComparison.OrdinalIgnoreCase)))
    throw new ArgumentException($"Access rule '{rule.Name}' already exists in NSP '{builder.Resource.Name}'.");

try { nspBuilder.WithAccessRule(rule); }
catch (ArgumentException ex) when (ex.Message.Contains("already exists")) { /* skip or rename the duplicate rule */ }

When it happens

Trigger: Calling WithAccessRule multiple times on the same NSP builder with rules whose Name values match ignoring case.

Common situations: Shared helper methods adding rules with a fixed name, config-driven rules where two entries resolve to the same name, or case-only differences mistaken for uniqueness.

Understand the failure class

Background: "already exists" / EEXIST / FileAlreadyExistsException: what the 'file already exists' error means and how to fix it — this error's family across 37 libraries.

Related errors

• An association named
• A security rule named
• A circular lifetime reference was detected for resource
• A global MCP approval policy cannot be combined with custom…
• adminPassword

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/0c5bcede00ef75e5. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Network/AzureNetworkSecurityPerimeterExtensions.cs:89

    ///     {
    ///         Name = "allow-outbound-fqdn",
    ///         Direction = NetworkSecurityPerimeterAccessRuleDirection.Outbound,
    ///         FullyQualifiedDomainNames = { "*.blob.core.windows.net" }
    ///     });
    /// </code>
    /// </example>
    [AspireExport]
    public static IResourceBuilder<AzureNetworkSecurityPerimeterResource> WithAccessRule(
        this IResourceBuilder<AzureNetworkSecurityPerimeterResource> builder,
        AzureNspAccessRule rule)
    {
        ArgumentNullException.ThrowIfNull(builder);
        ArgumentNullException.ThrowIfNull(rule);
        ArgumentException.ThrowIfNullOrEmpty(rule.Name);

        if (builder.Resource.AccessRules.Any(existing => string.Equals(existing.Name, rule.Name, StringComparison.OrdinalIgnoreCase)))
        {
            throw new ArgumentException(
                $"An access rule named '{rule.Name}' already exists in Network Security Perimeter '{builder.Resource.Name}'.",
                nameof(rule));
        }

        builder.Resource.AccessRules.Add(rule);
        return builder;
    }

    /// <summary>
    /// Associates an Azure PaaS resource with a Network Security Perimeter.
    /// </summary>
    /// <param name="target">The target PaaS resource builder to associate.</param>
    /// <param name="nsp">The Network Security Perimeter to associate with.</param>
    /// <param name="accessMode">
    /// The access mode for the association. Defaults to <see cref="NetworkSecurityPerimeterAssociationAccessMode.Enforced"/>.
    /// Use <see cref="NetworkSecurityPerimeterAssociationAccessMode.Learning"/> to log violations without blocking traffic.
    /// </param>
    /// <param name="associationName">

View on GitHub (pinned to 25830f84bd)