ReferenceRoleAssignmentAnnotation Constructors

1. Docs
2. /Reference
3. /Search C# APIs
4. /Aspire.Hosting.Azure
5. /ReferenceRoleAssignmentAnnotation
6. /Constructors

ClassConstructors1 member

Declares that any compute resource referencing the annotated resource should be granted ReferenceRoleAssignmentAnnotation.Roles on the Azure resource ReferenceRoleAssignmentAnnotation.Target.

Constructor(AzureProvisioningResource, IReadOnlySet<RoleDefinition>)

Declares that any compute resource referencing the annotated resource should be granted ReferenceRoleAssignmentAnnotation.Roles on the Azure resource ReferenceRoleAssignmentAnnotation.Target.

public sealed class ReferenceRoleAssignmentAnnotation
{
    public ReferenceRoleAssignmentAnnotation(
        AzureProvisioningResource target,
        IReadOnlySet<RoleDefinition> roles)
    {
        // ...
    }
}

ReferenceRoleAssignmentAnnotation.cs#L32-L42

Parameters

targetAzureProvisioningResourceThe Azure resource that referencing resources should be granted roles on.

rolesIReadOnlySet<RoleDefinition>The roles that referencing resources should be assigned on target.

Remarks

This annotation is applied to a resource that "fronts" an Azure resource without being an IAzureResource itself. For example, a Foundry hosted agent's node app is a plain compute resource, but invoking the agent requires the caller to hold a role on the owning Foundry account. The account is only a transitive dependency of a consumer, so Azure.AzureResourcePreparer 's normal reference walk — which only acts on direct IAzureResource dependencies — cannot reach it.

When a compute resource takes a direct dependency on a resource carrying this annotation, Azure.AzureResourcePreparer folds (Target, Roles) into the same role-assignment path used for direct Azure references, so the consumer gets a managed identity and the corresponding role assignment on ReferenceRoleAssignmentAnnotation.Target with no additional wiring.