Skip to content
DocsTry Aspire
DocsTry

ReferenceRoleAssignmentAnnotation Constructors

ClassConstructors1 member
Declares that any compute resource referencing the annotated resource should be granted ReferenceRoleAssignmentAnnotation.Roles on the Azure resource ReferenceRoleAssignmentAnnotation.Target.
Constructor(AzureProvisioningResource, IReadOnlySet<RoleDefinition>)Section titled Constructor(AzureProvisioningResource, IReadOnlySet<RoleDefinition>)
Declares that any compute resource referencing the annotated resource should be granted ReferenceRoleAssignmentAnnotation.Roles on the Azure resource ReferenceRoleAssignmentAnnotation.Target.
public sealed class ReferenceRoleAssignmentAnnotation
{
public ReferenceRoleAssignmentAnnotation(
AzureProvisioningResource target,
IReadOnlySet<RoleDefinition> roles)
{
// ...
}
}
targetAzureProvisioningResourceThe Azure resource that referencing resources should be granted roles on.
rolesIReadOnlySet<RoleDefinition>The roles that referencing resources should be assigned on target.

This annotation is applied to a resource that "fronts" an Azure resource without being an IAzureResource itself. For example, a Foundry hosted agent's node app is a plain compute resource, but invoking the agent requires the caller to hold a role on the owning Foundry account. The account is only a transitive dependency of a consumer, so Azure.AzureResourcePreparer 's normal reference walk — which only acts on direct IAzureResource dependencies — cannot reach it.

When a compute resource takes a direct dependency on a resource carrying this annotation, Azure.AzureResourcePreparer folds (Target, Roles) into the same role-assignment path used for direct Azure references, so the consumer gets a managed identity and the corresponding role assignment on ReferenceRoleAssignmentAnnotation.Target with no additional wiring.