All Aspire Azure hosting integrations define Azure resources. These resources come with default role assignments. You can replace these default role assignments with built-in roles or custom role assignments. In this article, you learn how to manage Azure role assignments on Aspire resources.
When you add an Azure resource to the AppHost, it’s assigned default roles. If a resource depends on another resource, it inherits the same role assignments as the referenced resource unless explicitly overridden.
Consider a scenario where an API project resource references an Azure Search resource. The API project is given the default role assignments, as shown in the following example:
In the example code, the api project resource depends on the Azure search resource, meaning it references the search resource. By default, the search resource is assigned the following built-in roles:
These role assignments allow the API project to read and write data to the Azure Search resource, and manage it. However, this behavior might not always be desirable. For instance, you might want to restrict the API project to only read data from the Azure Search resource.
Assigns the specified roles to the given resource, granting it the necessary permissions on the target Azure AI Search service resource. This replaces the default role assignments for the resource.
When you use the WithRoleAssignments method in C# or a resource-specific TypeScript role assignment method such as withSearchRoleAssignments, it replaces the default role assignments with the specified ones. This method requires two parameters: the resource to which the role assignment applies and the built-in role to assign. In the preceding example, the search resource is assigned the Azure.Provisioning.Search.SearchBuiltInRole.SearchIndexDataReader role.
When you replace the default role assignments with the SearchIndexDataReader role, the API project is restricted to only reading data from the Azure Search resource. This ensures the API project can’t write data to the Azure Search resource.
Aspire represents each set of role assignments as an AzureRoleAssignmentResource in the distributed application model. You can enumerate these resources to inspect what role assignments are configured, which Azure resource they target, and which Aspire resource owns them. This is useful in pipeline steps that need to reason about security configuration before deployment.
AzureRoleAssignmentResource exposes three properties:
Property
Type
Description
TargetAzureResource
AzureProvisioningResource
The Azure resource that the roles are assigned on (the scope, for example, a Key Vault or Storage account).
OwnerResource
IResource?
The Aspire resource whose managed identity receives the role assignments (the resource on which WithRoleAssignments was called). null for global role assignments granted to the deployment principal.
IdentityResource
AzureUserAssignedIdentityResource?
The user-assigned managed identity whose principal receives the role assignments. null for global role assignments granted to the deployment principal.
The following example shows how to add a pipeline step that runs during WellKnownPipelineSteps.BeforeStart and enumerates all AzureRoleAssignmentResource instances that target a specific Azure resource:
AppHost.cs
#pragmawarningdisable ASPIREAZURE001 // AzureEnvironmentResource is Experimental
var builder =DistributedApplication.CreateBuilder(args);
All built-in roles are defined within the Azure.Provisioning namespaces and are included in the corresponding 📦 Azure.Provisioning.* NuGet packages. Each Aspire Azure hosting integration automatically depends on the appropriate provisioning package. For more information, see Customized Azure resources.
The following sections list the built-in roles for each Azure provisioning type that can be used as a parameter to the WithRoleAssignments API.
The provisioning resource type is Azure.Provisioning.AppConfiguration.AppConfigurationStore, and the built-in roles are defined in the Azure.Provisioning.AppConfiguration.AppConfigurationBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.AppContainers.ContainerApp, and the built-in roles are defined in the Azure.Provisioning.AppContainers.AppContainersBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.ApplicationInsights.ApplicationInsightsComponent, and the built-in roles are defined in the Azure.Provisioning.ApplicationInsights.ApplicationInsightsBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.CognitiveServices.CognitiveServicesAccount, and the built-in roles are defined in the Azure.Provisioning.CognitiveServices.CognitiveServicesBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.CosmosDB.CosmosDBAccount, and the built-in roles are defined in the Azure.Provisioning.CosmosDB.CosmosDBBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.EventHubs.EventHubsNamespace, and the built-in roles are defined in the Azure.Provisioning.EventHubs.EventHubsBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.KeyVault.KeyVaultService, and the built-in roles are defined in the Azure.Provisioning.KeyVault.KeyVaultBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.Search.SearchService, and the built-in roles are defined in the Azure.Provisioning.Search.SearchBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.ServiceBus.ServiceBusNamespace, and the built-in roles are defined in the Azure.Provisioning.ServiceBus.ServiceBusBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.SignalR.SignalRService, and the built-in roles are defined in the Azure.Provisioning.SignalR.SignalRBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.Sql.SqlServer, and the built-in roles are defined in the Azure.Provisioning.Sql.SqlBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.Storage.StorageAccount, and the built-in roles are defined in the Azure.Provisioning.Storage.StorageBuiltInRole struct. The built-in roles are:
The provisioning resource type is Azure.Provisioning.WebPubSub.WebPubSubService, and the built-in roles are defined in the Azure.Provisioning.WebPubSub.WebPubSubBuiltInRole struct. The built-in roles are:
