Incremental deployments tries to delete privateDnsZoneConfigs in PrivateEndpoints

[swordfish291]

I am trying to deploy Azure OpenAI using bicep modules. The first deployment goes successful however, the subsequest incremental deployments tries to delete properties.privateDnsZoneConfigs Here is my bicep code:

resource openai_instance 'Microsoft.CognitiveServices/accounts@2023-05-01' = {
  name: openAIInstanceName
  location: location
  tags: tags
  sku: {
    name: skuName
  }
  kind: 'OpenAI'
  properties: {
    disableLocalAuth: true
    publicNetworkAccess: 'Disabled'
    networkAcls: {
      defaultAction: 'Deny'
    }
    customSubDomainName: toLower(openAIInstanceName)
  }
}

resource privateEndpoint 'Microsoft.Network/privateEndpoints@2023-04-01' = {
  name: privateEndpointName
  location: peplocation
  tags: tags
  
  properties: {
    subnet: {
      id: resourceId(vnetResourceGroup, 'Microsoft.Network/virtualNetworks/subnets', vnetName, subnetName)
    }
    privateLinkServiceConnections: [
      {
        name: 'openAIPrivateLinkConnection'
        properties: {
          privateLinkServiceId: openai_instance.id
          groupIds: [
            'account'
          ]
        }
      }
    ]
  }
  resource privateEndpointDnsEntry 'privateDnsZoneGroups@2023-04-01' = {
    name: 'default'
    properties: {
      privateDnsZoneConfigs: [
        {
          name: 'config'
          properties: {
            privateDnsZoneId: PrivateDnsZoneId
          }
        }
      ]
    }
  }
}

var roleDefinitionResourceId = '/providers/Microsoft.Authorization/roleDefinitions/5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: openai_instance
  name: guid(openai_instance.id, principalId, roleDefinitionResourceId)
  properties: {
    roleDefinitionId: roleDefinitionResourceId
    principalId: principalId
    principalType: principalType
  }
}resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: openai_instance
  name: guid(openai_instance.id, principalId, roleDefinitionResourceId)
  properties: {
    roleDefinitionId: roleDefinitionResourceId
    principalId: principalId
    principalType: principalType
  }
}

the subsequent incremental deployments without any change throw this what-if output:

Resource and property changes are indicated with these symbols:
  - Delete
  ~ Modify
  = Nochange
  * Ignore
  x Noeffect

The deployment will update the following scope:

Scope: /subscriptions/xxxxxxx/resourceGroups/open-ai-xxxx

  ~ Microsoft.CognitiveServices/accounts/openai-xxxxx/providers/Microsoft.Authorization/roleAssignments/9caf4209-xxxx-xxxxx-b7c5-b4b9f14xxxe9 [2022-04-01]
    ~ properties.roleDefinitionId: "/subscriptions/xxxxxxxxxxxx/providers/Microsoft.Authorization/roleDefinitions/5e0bd9bd-7b93-4f28-af87-19fc36ad61bd" => "/providers/Microsoft.Authorization/roleDefinitions/5e0bd9bd-7b93-4f28-af87-19fc36ad61bd"
    x properties.principalType:    "Group"

  ~ Microsoft.Network/privateEndpoints/openai-xxxxxx-pep/privateDnsZoneGroups/default [2023-04-01]
    ~ properties.privateDnsZoneConfigs: [
      ~ 0:

        - etag:                         "W/"047ed8f9-5291-43e0-87e0-4d03fecbe9fc""
        - id:                           "/subscriptions/xxxxxxxxxx/resourceGroups/open-ai-xxxxx-rg/providers/Microsoft.Network/privateEndpoints/openai-xxxxx-pep/privateDnsZoneGroups/default/privateDnsZoneConfigs/config"
        - properties.provisioningState: "Succeeded"
        - type:                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/privateDnsZoneConfigs"

      ]

  = Microsoft.CognitiveServices/accounts/openai-xxxxx-01 [2023-05-01]
  = Microsoft.Network/privateEndpoints/openai-xxxxx-pep [2023-04-01]

[pm7y]

I'm also seeing the same behaviour. It doesn't actually delete it though, it's just annoying to constantly see this are deletion warning in the what-if output.

[uky2019]

I get similar results when adding a subnet to vnet, if I add subnet in the middle of other subnet instead on the end of the code, whatif reports that everything will get modified / deleted etc, but in reality only subnet is added and nothing else is touched,... This whatif outputs are bit unreliable for some actions...