Stop ViteApps (build only containers) from getting Azure managed identities and roles

src/Aspire.Hosting.Azure/AzureResourcePreparer.cs

@@ -125,19 +125,13 @@ private async Task BuildRoleAssignmentAnnotations(DistributedApplicationModel ap
             // - if in PublishMode
             //   - if a compute resource has RoleAssignmentAnnotations, use them
             //   - if the resource doesn't, copy the DefaultRoleAssignments to RoleAssignmentAnnotations to apply the defaults
-            var resourceSnapshot = appModel.Resources.ToArray(); // avoid modifying the collection while iterating
+            var resourceSnapshot = appModel.GetComputeResources()
+                .Concat(appModel.Resources
+                    .OfType<AzureUserAssignedIdentityResource>()
+                    .Where(r => !r.IsExcludedFromPublish()))
+                .ToArray(); // avoid modifying the collection while iterating
             foreach (var resource in resourceSnapshot)
             {
-                if (resource.IsExcludedFromPublish())
-                {
-                    continue;
-                }
-
-                if (!IsResourceValidForRoleAssignments(resource))
-                {
-                    continue;
-                }
-
                 var azureReferences = await GetAzureReferences(resource, cancellationToken).ConfigureAwait(false);
 
                 var azureReferencesWithRoleAssignments =
@@ -231,13 +225,6 @@ private async Task BuildRoleAssignmentAnnotations(DistributedApplicationModel ap
         {
             CreateGlobalRoleAssignments(appModel, globalRoleAssignments);
         }
-
-        // We can derive role assignments for compute resources and declared
-        // AzureUserAssignedIdentityResources
-        static bool IsResourceValidForRoleAssignments(IResource resource)
-        {
-            return resource.IsContainer() || resource is ProjectResource || resource is AzureUserAssignedIdentityResource;
-        }
     }
 
     private static Dictionary<AzureProvisioningResource, IEnumerable<RoleDefinition>> GetAllRoleAssignments(IResource resource)

tests/Aspire.Hosting.Azure.Tests/Aspire.Hosting.Azure.Tests.csproj

@@ -9,6 +9,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <ProjectReference Include="..\..\src\Aspire.Hosting.JavaScript\Aspire.Hosting.JavaScript.csproj" />
     <ProjectReference Include="..\..\src\Aspire.Hosting.Azure.AIFoundry\Aspire.Hosting.Azure.AIFoundry.csproj" />
     <ProjectReference Include="..\..\src\Aspire.Hosting.Azure.AppConfiguration\Aspire.Hosting.Azure.AppConfiguration.csproj" />
     <ProjectReference Include="..\..\src\Aspire.Hosting.Azure.AppService\Aspire.Hosting.Azure.AppService.csproj" />

tests/Aspire.Hosting.Azure.Tests/AzureResourcePreparerTests.cs

@@ -297,6 +297,45 @@ public async Task AppliesRoleAssignmentsOnlyToDirectReferences()
             n => Assert.Equal("api-roles-storage", n));
     }
 
+    [Fact]
+    public async Task ViteAppDoesNotGetManagedIdentity()
+    {
+        using var builder = TestDistributedApplicationBuilder.Create(DistributedApplicationOperation.Publish);
+        builder.AddAzureContainerAppEnvironment("env");
+
+        var storage = builder.AddAzureStorage("storage");
+        var blobs = storage.AddBlobs("blobs");
+
+        var api = builder.AddProject<Project>("api", launchProfileName: null)
+            .WithHttpEndpoint()
+            .WithReference(blobs)
+            .WaitFor(blobs);
+
+        var frontend = builder.AddViteApp("frontend", "./frontend")
+            .WithReference(api)
+            .WithReference(blobs)
+            .WaitFor(blobs);
+
+        using var app = builder.Build();
+        var model = app.Services.GetRequiredService<DistributedApplicationModel>();
+        await ExecuteBeforeStartHooksAsync(app, default);
+
+        Assert.Collection(model.Resources.Select(r => r.Name),
+            n => Assert.StartsWith("azure", n),
+            n => Assert.Equal("env-acr", n),
+            n => Assert.Equal("env", n),
+            n => Assert.Equal("storage", n),
+            n => Assert.Equal("blobs", n),
+            n => Assert.Equal("api", n),
+            n => Assert.Equal("frontend", n),
+            n => Assert.Equal("api-identity", n),
+            n => Assert.Equal("api-roles-storage", n));
+
+        // The ViteApp should NOT get a managed identity since it is a BuildOnlyContainer resource,
+        // even though it references the storage account. Only the API should get a managed identity.
+        Assert.DoesNotContain(model.Resources, r => r.Name == "frontend-identity");
+    }
+
     private sealed class Project : IProjectMetadata
     {
         public string ProjectPath => "project";