microsoft / microsoft/aspire

Azure SQL provisioning adds user identity to all databases not just referenced

Open
#15,213 0 comments 0 reactions 0 assignees View on GitHub
area-integrations azure-sqlserver
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

When allowing a container app to access a database created with `Aspire.Hosting.Azure.Sql` via `WithReference`, the generated bicep file creates a deployment script per database to add the user identity instead of just per database referenced by the container app. This causes the container app to have access to databases it should not have access to and lots of unnecessary azure deployment scripts being created.

You can see in [AddRoleAssignments of AzureSqlServerResource](https://github.com/dotnet/aspire/blob/5f811278400919867dbddadcb6283149b42227b8/src/Aspire.Hosting.Azure.Sql/AzureSqlServerResource.cs#L290) that the foreach loop just goes through all databases.

### Expected Behavior

Container app's identity only has access to databases that it directly references to stop the potential of an application accessing a database it has no need to access which is on the same server.

### Steps To Reproduce

- Create the aspire starter template project.
- Add `Aspire.Hosting.Azure.AppContainers` and `Aspire.Hosting.Azure.Sql`
- Add a sql server with multiple databases and reference just database from a container app e.g
Image
- run `aspire do publish`

### Exceptions (if any)

In our case this breaks aspire deploy with the following issue, due to too many trying to run in parallel:

`DeploymentScriptContainerInstancesQuotaReachedException: Resource type 'Microsoft.ContainerInstance/containerGroups' container group quota 'StandardCores' exceeded in region '***'. Limit: '10', Usage: '10' Requested: '1'`

This could be a common issue to run into as solutions grow as well, so might need a way to reduce parallelisation to within quote limits.

### .NET Version info

.NET SDK:
Version: 10.0.102
Commit: 4452502459
Workload version: 10.0.100-manifests.6d969a7e
MSBuild version: 18.0.7+445250245

### Anything else?

Aspire 13.1.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.