[AVM Module Issue]: avm.res.synapse.workspace Workspace using CMK unable to deploy when Keyvault resource is located in a different resource group

[chris-gibbs]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Bug

Module Name

avm/res/synapse/workspace

(Optional) Module Version

No response

Description

The scope keeps getting evaluated as resourceGroup() when passing in encryptionActivateWorkspace true and customerManagedKey.keyVaultResourceId set to a kevvault resource located in a different resource group.

main.bicep

  module workspace_cmk_rbac 'modules/nested_cmkRbac.bicep' = if (encryptionActivateWorkspace) {
    name: '${workspace.name}-cmk-rbac'
    params: {
      workspaceIndentityPrincipalId: workspace.identity.principalId
      keyvaultName: !empty(customerManagedKey.?keyVaultResourceId) ? cMKKeyVault.name : ''
      usesRbacAuthorization: !empty(customerManagedKey.?keyVaultResourceId)
        ? cMKKeyVault.properties.enableRbacAuthorization
        : true
    }
    scope: encryptionActivateWorkspace
      ? resourceGroup(
          split((customerManagedKey.?keyVaultResourceId ?? '//'), '/')[2],
          split((customerManagedKey.?keyVaultResourceId ?? '////'), '/')[4]
        )
      : resourceGroup()
  }

(Optional) Correlation Id

No response

[microsoft-github-policy-service]

Important

The "Needs: Triage 🔍" label must be removed once the triage process is complete!

Tip

For additional guidance on how to triage this issue/PR, see the BRM Issue Triage documentation.

[avm-team-linter]

@chris-gibbs, thanks for submitting this issue for the avm/res/synapse/workspace module!

Important

Please note, that this module is currently orphaned. The @Azure/avm-core-team-technical-bicep, will attempt to find an owner for it. In the meantime, the core team may assist with this issue. Thank you for your patience!

[AlexanderSehr]

Hey @chris-gibbs,
would you happen to have a pipeline run available we could check out?
Quite surprising that the logic does not kick in. Then again, it's anyways a bit special that it has this extra scope case handling in the first place (compared to most of not all other module implementations).