ReferenceRoleAssignmentAnnotation Constructors
ReferenceRoleAssignmentAnnotation.Roles on the Azure resource ReferenceRoleAssignmentAnnotation.Target. Constructor(AzureProvisioningResource, IReadOnlySet<RoleDefinition>)Section titled Constructor(AzureProvisioningResource, IReadOnlySet<RoleDefinition>)ReferenceRoleAssignmentAnnotation.Roles on the Azure resource ReferenceRoleAssignmentAnnotation.Target. public sealed class ReferenceRoleAssignmentAnnotation{ public ReferenceRoleAssignmentAnnotation( AzureProvisioningResource target, IReadOnlySet<RoleDefinition> roles) { // ... }}Parameters
targetAzureProvisioningResourceThe Azure resource that referencing resources should be granted roles on.rolesIReadOnlySet<RoleDefinition>The roles that referencing resources should be assigned on target.Remarks
This annotation is applied to a resource that "fronts" an Azure resource without being an IAzureResource itself. For example, a Foundry hosted agent's node app is a plain compute resource, but invoking the agent requires the caller to hold a role on the owning Foundry account. The account is only a transitive dependency of a consumer, so Azure.AzureResourcePreparer 's normal reference walk — which only acts on direct IAzureResource dependencies — cannot reach it.
When a compute resource takes a direct dependency on a resource carrying this annotation, Azure.AzureResourcePreparer folds (Target, Roles) into the same role-assignment path used for direct Azure references, so the consumer gets a managed identity and the corresponding role assignment on ReferenceRoleAssignmentAnnotation.Target with no additional wiring.