microsoft/aspire · error · InvalidOperationException

Secret ' ' not found in Key Vault ' '.

Error message

Secret '{secretName}' not found in Key Vault '{azureKeyVaultResource.Name}'.

What it means

Resolving a secret's value via GetValueAsync requires a SecretResolver to have been registered on the AzureKeyVaultResource (typically wired when the app actually runs against the vault). If no resolver is set, the reference cannot be resolved and this InvalidOperationException is thrown naming the secret and vault.

Solutions

Ensure the application is running in run mode with proper Azure credentials so the SecretResolver is registered on the vault resource.
In tests, set azureKeyVaultResource.SecretResolver to a test delegate returning the expected value.
Do not resolve secret values at publish/manifest time; resolve them only in the running app or from IConfiguration.
Verify the secret actually exists in the vault if a custom resolver filters by existence.

Example fix

// before (test)
var value = await secretReference.GetValueAsync(ct);

// after (test)
vaultResource.SecretResolver = (r, ct) => ValueTask.FromResult("test-secret");
var value = await secretReference.GetValueAsync(ct);

Defensive patterns

Strategy: try-catch

Validate before calling

if (azureKeyVaultResource.SecretResolver is null)
{
    throw new InvalidOperationException("No secret resolver registered; secret values can only be resolved while the app is running against the vault.");
}

Try / catch

try { var value = await secretRef.GetValueAsync(ct); }
catch (InvalidOperationException ex) when (ex.Message.Contains("not found in Key Vault")) { /* fall back to config or fail with a clear message */ }

Prevention

Resolve secret values only inside the running distributed application, not at publish/manifest time.
In tests, always set SecretResolver on the vault resource before resolving.
Verify the secret exists in the target vault before referencing it.

When it happens

Trigger: Calling IAzureKeyVaultSecretReference.GetValueAsync when the AzureKeyVaultResource.SecretResolver is null — e.g. in publish/manifest mode, in unit tests constructing the reference manually, or before the vault resource's client factory has been configured.

Common situations: Running or testing code that resolves secrets without a live Azure environment, using the secret reference outside the distributed application runtime, or mocking the vault resource without setting SecretResolver.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/7429303303d0abf1. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.KeyVault/AzureKeyVaultSecretReference.cs:39

    /// Gets the Azure Key Vault resource.
    /// </summary>
    public IAzureKeyVaultResource Resource => azureKeyVaultResource;

    /// <summary>
    /// Gets or sets the resource that writes this secret to the Key Vault.
    /// </summary>
    public IResource? SecretOwner { get; set; }

    string IManifestExpressionProvider.ValueExpression => $"{{{azureKeyVaultResource.Name}.secrets.{SecretName}}}";

    async ValueTask<string?> IValueProvider.GetValueAsync(CancellationToken cancellationToken)
    {
        if (azureKeyVaultResource.SecretResolver is { } secretResolver)
        {
            return await secretResolver(this, cancellationToken).ConfigureAwait(false);
        }

        throw new InvalidOperationException($"Secret '{secretName}' not found in Key Vault '{azureKeyVaultResource.Name}'.");
    }
}

View on GitHub (pinned to 25830f84bd)