Add AzureServiceTags with common Azure service tags for NSG rules

[Copilot]

Description

Adds AzureServiceTags static class providing well-known Azure service tag constants for use as from/to parameters in NSG rule methods and AzureSecurityRule address prefix properties. This gives users discoverability via IntelliSense instead of requiring them to know the magic strings.

Tags included: Internet, VirtualNetwork, AzureLoadBalancer, AzureTrafficManager, Storage, Sql, AzureCosmosDB, AzureKeyVault, EventHub, ServiceBus, AzureContainerRegistry, AppService, AzureActiveDirectory, AzureMonitor, GatewayManager

var subnet = vnet.AddSubnet("web", "10.0.1.0/24")
    .AllowInbound(port: "443", from: AzureServiceTags.AzureLoadBalancer, protocol: SecurityRuleProtocol.Tcp)
    .DenyInbound(from: AzureServiceTags.Internet);

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No
• Does the change require an update in our Aspire docs?
  • Yes
    • Link to aspire.dev issue:
      • New issue
  • No

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 14452

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 14452"

[Copilot]

Pull request overview

Adds a new AzureServiceTags public API to the Azure Network hosting integration, giving users IntelliSense-friendly constants for common Azure NSG service-tag strings when authoring AzureSecurityRules or using VNet subnet shorthand rule methods.

Changes:

• Introduces AzureServiceTags static class with well-known Azure service tag constants.
• Updates docs and examples to use AzureServiceTags instead of magic strings.
• Adds/updates unit tests to validate service tag usage in shorthand APIs and rule properties.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/Aspire.Hosting.Azure.Tests/AzureVirtualNetworkExtensionsTests.cs	Adds coverage validating service tags work in subnet shorthand methods and AzureSecurityRule properties.
tests/Aspire.Hosting.Azure.Tests/AzureNetworkSecurityGroupExtensionsTests.cs	Replaces hard-coded service tag strings with AzureServiceTags in tests.
src/Aspire.Hosting.Azure.Network/README.md	Updates README sample to use AzureServiceTags for discoverability.
src/Aspire.Hosting.Azure.Network/AzureVirtualNetworkExtensions.cs	Updates XML doc example to use AzureServiceTags.
src/Aspire.Hosting.Azure.Network/AzureServiceTags.cs	Adds the new public API and XML documentation.
playground/AzureVirtualNetworkEndToEnd/AzureVirtualNetworkEndToEnd.AppHost/Program.cs	Updates playground usage to use AzureServiceTags.

[github-actions]

🎬 CLI E2E Test Recordings

The following terminal recordings are available for commit cd498fb:

Test	Recording
AgentCommands_AllHelpOutputs_AreCorrect	▶️ View Recording
AgentInitCommand_MigratesDeprecatedConfig	▶️ View Recording
Banner_DisplayedOnFirstRun	▶️ View Recording
Banner_DisplayedWithExplicitFlag	▶️ View Recording
CreateAndDeployToDockerCompose	▶️ View Recording
CreateAndDeployToDockerComposeInteractive	▶️ View Recording
CreateAndPublishToKubernetes	▶️ View Recording
CreateAndRunAspireStarterProject	▶️ View Recording
CreateAndRunAspireStarterProjectWithBundle	▶️ View Recording
CreateAndRunJsReactProject	▶️ View Recording
CreateAndRunPythonReactProject	▶️ View Recording
CreateEmptyAppHostProject	▶️ View Recording
CreateStartAndStopAspireProject	▶️ View Recording
CreateStartWaitAndStopAspireProject	▶️ View Recording
CreateTypeScriptAppHostWithViteApp	▶️ View Recording
DoctorCommand_DetectsDeprecatedAgentConfig	▶️ View Recording
DoctorCommand_WithSslCertDir_ShowsTrusted	▶️ View Recording
DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	▶️ View Recording
LogsCommandShowsResourceLogs	▶️ View Recording
PsCommandListsRunningAppHost	▶️ View Recording
ResourcesCommandShowsRunningResources	▶️ View Recording
StagingChannel_ConfigureAndVerifySettings_ThenSwitchChannels	▶️ View Recording

---

_{📹 Recordings uploaded automatically from CI run #22147860692}

[mitchdenny]

This is a huge leap forward in capability. Loving it.