bicep managed SQL instance deployment error

[pchettri3]

Managed SQL instance gets deployed with error. Does bicep needs NSG and custom route even in an environment where there is a secured hub with vwan?

param location string
param resourceGroupName string
param administratorLogin string
@secure()
param administratorLoginPassword string
param subnetId string
//param privateDnsZoneArmResourceId string
var serverName = replace(resourceGroupName, 'rg', 'sqlmi')
//var backupRetentionDays = contains(resourceGroupName, 'prd') ? 30 : 15

resource sqlManagedInstance 'Microsoft.Sql/managedInstances@2023-02-01-preview' = {
name: serverName
location: location
sku: {
name: 'GP_Gen5'
tier: 'GeneralPurpose'
family: 'Gen5'
capacity: 4
}
identity: {
type: 'SystemAssigned'
}
properties: {
isGeneralPurposeV2: false
administratorLogin: administratorLogin
administratorLoginPassword: administratorLoginPassword
subnetId: subnetId
licenseType: 'BasePrice'
hybridSecondaryUsage: 'Active'
vCores: 4
storageSizeInGB: 64
collation: 'SQL_Latin1_General_CP1_CI_AS'
publicDataEndpointEnabled: false
proxyOverride: 'Proxy'
timezoneId: 'US Mountain Standard Time'
minimalTlsVersion: '1.2'
requestedBackupStorageRedundancy: 'Local'
zoneRedundant: false
pricingModel: 'Regular'
}
}

error

, "message": "The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.", "details": [ {
| "code": "DeploymentFailed", "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations
| for usage details.", "details": [ { "code": "NotFound", "message": "{\r\n "error": {\r\n "code": "ResourceNotFound",\r\n "message": "The
| specified resource does not exist. Follow this link for more information

Managed instance create operation failed or canceled. Please delete and recreate.

[johnpetersjr]

I've seen on a few occasions, if I'm trying to build something via automation, and it fails, if you go look in the Azure Portal you will see a remnant of your attempt, with the name you specified (GP_Gen5?) sitting there in the portal in a 'Failed' state. I normally have to delete those 'Failed' attempts manually before attempting to redeploy... might be worth checking?

[pchettri3]

In the previous project I used to build with terraform. I will have to compare what is different on Terraform that works successfully. I think tf my have have dependency defined while bicep docs does have it

[pchettri3]

Portal deployment works. When I used bicep deployment it creates bunch of phantom NSG and redeployment fails

[kevball2]

https://github.com/Azure/ResourceModules/tree/main/modules/sql/managed-instance

Use this as a template or reference, we can successfully deploy and redeploy our instances using this as our generalized module. A caveat, if you want to use Entra ID Admins, you will need a user assigned Identity that has the Entra ID role Directory Reader to be able to add or change Entra Id Admins. This can be setup before you deploy, or if you want completely to automate you could use a deployment script to assign the Entra Role (This might be a security issue for your org)