microsoft/aspire · error · InvalidOperationException

Azure Cognitive Services project resource

Error message

Azure Cognitive Services project resource '{builder.Resource.Name}' already has a Key Vault connection configured.

What it means

WithKeyVault() attaches a Key Vault connection to an Azure Cognitive Services (Foundry) project resource and assigns the Key Vault Secrets Officer role. The library throws this InvalidOperationException when the project resource already has a KeyVaultConn configured, because only one Key Vault connection per project is supported.

Solutions

Remove the duplicate WithKeyVault() call so it runs only once per project resource
Check builder.Resource.KeyVaultConn for null (or track a bool flag) before calling WithKeyVault
Split configuration so each project resource gets exactly one Key Vault connection

Example fix

// before
var project = foundry.AddProject("proj").WithKeyVault(kvA).WithKeyVault(kvB);

// after
var project = foundry.AddProject("proj").WithKeyVault(kvA);

Defensive patterns

Strategy: validation

Validate before calling

if (project.Resource.KeyVaultConn is null)
{
    project.WithKeyVault(keyVault);
}

Try / catch

try { project.WithKeyVault(keyVault); }
catch (InvalidOperationException ex) when (ex.Message.Contains("already has a Key Vault connection"))
{
    // Key Vault already attached; skip.
}

Prevention

Call WithKeyVault exactly once per project resource, ideally at its creation site
Centralize project configuration in one method to avoid duplicate calls
Guard with a null check on KeyVaultConn before calling

When it happens

Trigger: Calling WithKeyVault() twice on the same IResourceBuilder<AzureCognitiveServicesProjectResource>, e.g. in a shared extension method that also calls it, or copy-pasting configuration blocks that each attach a Key Vault.

Common situations: Refactoring AppHost code where WithKeyVault was moved but not removed from the old location; conditionally configuring Key Vault in multiple helper methods; merging two AppHost configuration branches that both call WithKeyVault.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/fd8b885f83b1be30. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Foundry/Project/ProjectBuilderExtension.cs:99

    /// <summary>
    /// Adds a Key Vault connection to the Microsoft Foundry project.
    /// </summary>
    /// <param name="builder">The resource builder for the Microsoft Foundry project.</param>
    /// <param name="keyVault">The Key Vault resource to associate with the project.</param>
    /// <returns>A reference to the <see cref="IResourceBuilder{T}"/> for chaining.</returns>
    /// <ats-returns>The resource builder.</ats-returns>
    /// <exception cref="InvalidOperationException">Thrown when the project already has a Key Vault connection configured.</exception>
    [AspireExport]
    public static IResourceBuilder<AzureCognitiveServicesProjectResource> WithKeyVault(
        this IResourceBuilder<AzureCognitiveServicesProjectResource> builder,
        IResourceBuilder<AzureKeyVaultResource> keyVault)
    {
        ArgumentNullException.ThrowIfNull(builder);
        ArgumentNullException.ThrowIfNull(keyVault);
        if (builder.Resource.KeyVaultConn is not null)
        {
            throw new InvalidOperationException($"Azure Cognitive Services project resource '{builder.Resource.Name}' already has a Key Vault connection configured.");
        }

        var conn = builder.AddConnection(keyVault);
        // We need to keep a reference to the connection resource for dependency tracking
        builder.Resource.KeyVaultConn = conn.Resource;
        return builder.WithRoleAssignments(keyVault, KeyVaultBuiltInRole.KeyVaultSecretsOfficer);
    }

    /// <summary>
    /// Adds an Application Insights resource to the Microsoft Foundry project,
    /// overriding the default (which is to create a new Application Insights resource).
    /// </summary>
    /// <param name="builder">The resource builder for the Microsoft Foundry project.</param>
    /// <param name="appInsights">The Application Insights resource to associate with the project.</param>
    /// <returns>A reference to the <see cref="IResourceBuilder{T}"/> for chaining.</returns>
    /// <ats-returns>The resource builder.</ats-returns>
    [AspireExport]
    public static IResourceBuilder<AzureCognitiveServicesProjectResource> WithAppInsights(

View on GitHub (pinned to 25830f84bd)