Private Deployment Script unexpected SubnetId error

[johnlokerse]

Hi all,

A while back, I created a snippet to illustrate the concept of private deployment scripts. This snippet functioned well at the time. However, when I revisited it today, it generated an error that I couldn’t understand:

{"code": "InvalidTemplateDeployment", "message": "The template deployment 'privateDeploymentScripts' is not valid according to the validation procedure. The tracking id is 'xxx'. See inner errors for details."}

Inner Errors:
{"code": "DeploymentPreflightValidationFailed", "target": "/subscriptions/xxx/resourceGroups/rg-pdst/providers/Microsoft.Resources/deploymentScripts/my-private-deployment-script", "message": "One of the Id properties of objects in the SubnetIds array is invalid. The Id cannot be null, empty or whitespace. It should be a valid Azure resource Id."}

This is the snippet I am working with (click here for the full Bicep template):

resource resPrivateDeploymentScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
  name: 'my-private-deployment-script'
  dependsOn: [
    resPrivateEndpoint
    resPrivateDnsZone::resVirtualNetworkLink
  ]
  location: parLocation
  kind: 'AzurePowerShell'
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${resManagedIdentity.id}' : {}
    }
  }
  properties: {
    storageAccountSettings: {
      storageAccountName: resStorageAccount.name
    }
    containerSettings: {
      subnetIds: [
        {
          id: first(filter(resVirtualNetwork.properties.subnets, subnet => subnet.name == 'ContainerInstanceSubnet'))!.id
        }
      ]
    }
    azPowerShellVersion: '9.0'
    retentionInterval: 'P1D'
    scriptContent: 'Write-Host "Hello World!"'
  }
}

The error is thrown at the id property in the subnetIds array under containerSettings. At first glance, the error seems obvious, so I double-checked if the id was empty. To confirm this, I created an output, but it shows the correct id.

    "outputs": {
      "outContainerSubnetId": {
        "type": "String",
        "value": "/subscriptions/xxx/resourceGroups/rg-pdst/providers/Microsoft.Network/virtualNetworks/my-vnet/subnets/ContainerInstanceSubnet"
      }
    }

If I place the output of outContainerSubnetId as a hardcoded string in the subnetIds array property it goes through validation and deploys correctly. However, the Bicep extension requests a symbolic resource reference:

Other solutions

I have tried other ways to see if it works or not:

    containerSettings: {
      subnetIds: [
// Does not work. Same error!
        {
          id: first(filter(resVirtualNetwork.properties.subnets, subnet => subnet.name == 'ContainerInstanceSubnet'))!.id
        }
// Does not work. Same error!
        {
          id: resVirtualNetwork.properties.subnets[1].id
        }
// Works!
        {
          id: resVirtualNetwork::resContainerInstanceSubnet.id
        }
// Works!
        {
          id: 'hardcoded id'
        }
      ]
    }

What am I missing here?