microsoft/aspire · error · InvalidOperationException

Could not generate a unique name for security rule

Error message

Could not generate a unique name for security rule '{baseName}'

What it means

When a shorthand rule is added, the NSG generates a unique rule name by appending -2, -3, ... to the base name, scanning existing rule names. If even 'baseName-99' collides (i.e., 99 candidates already exist), it gives up and throws InvalidOperationException rather than looping forever.

Solutions

Give each rule a distinct, descriptive base name instead of reusing one base for many rules.
Reduce the number of rules by consolidating (use CIDR ranges or port ranges instead of many single rules).
Check for accidental loops that add the same rule many times; the NSG likely contains duplicates to clean up.
If needed, catch InvalidOperationException and pick explicit unique names yourself.

Example fix

// before
for (var i = 0; i < 150; i++)
    nsg.AllowInbound("allow-app", 8000 + i); // base name reused 150x

// after
for (var i = 0; i < 150; i++)
    nsg.AllowInbound($"allow-app-{i}", 8000 + i);

Defensive patterns

Strategy: try-catch

Validate before calling

int collisions = nsg.Resource.SecurityRules.Count(r => r.Name.StartsWith(baseName));
if (collisions >= 99) { /* choose explicit unique names instead of relying on suffixing */ }

Try / catch

try { nsg.AllowInbound(baseName, port); }
catch (InvalidOperationException ex) when (ex.Message.Contains("Could not generate a unique name")) { /* pass a fully unique rule name explicitly */ }

Prevention

Give each security rule a unique, descriptive base name — don't reuse one name for many rules.
Consolidate rules with CIDR/port ranges instead of generating hundreds of similar rules.
Watch for accidental loops that repeatedly add rules with the same name.

When it happens

Trigger: Adding ~100 or more rules to a single NSG sharing the same base rule name, so every suffixed candidate 'base-2'...'base-99' already exists in nsgResource.SecurityRules.

Common situations: Programmatically generating many per-IP or per-port rules with identical base names in a loop; a bug causing the same rule to be added repeatedly; extremely large NSGs near Azure's rule limits.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/7bf7736417d2e2d2. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Network/AzureVirtualNetworkExtensions.cs:673

        }

        nsgResource.SecurityRules.Add(rule);

        return builder;
    }

    private static string GenerateUniqueRuleName(AzureNetworkSecurityGroupResource nsgResource, string access, string direction, string? port, string? from, string? to)
    {
        var baseName = GenerateRuleName(access, direction, port, from, to);

        // Check for conflicts and append an index if needed
        var candidateName = baseName;
        var index = 2;
        while (nsgResource.SecurityRules.Any(r => r.Name == candidateName))
        {
            if (index == 100)
            {
                throw new InvalidOperationException($"Could not generate a unique name for security rule '{baseName}'");
            }
            candidateName = $"{baseName}-{index}";
            index++;
        }

        return candidateName;
    }

    private static string GenerateRuleName(string access, string direction, string? port, string? from, string? to)
    {
        var parts = new List<string> { access, direction };

        if (port is not null)
        {
            parts.Add(port);
        }

        if (from is not null)

View on GitHub (pinned to 25830f84bd)