Creating service endpoints on a subnet fails, without error message

[gevaertw]

I'm trying to create a subnet with service endpoints enabled. Following the documentation this should work. Upon deployment, I don't get any warnings or errors, the subnet is deployed without service endpoints.

resource cycleCloudvNet_R 'Microsoft.Network/virtualNetworks@2023-04-01' = {
  name: cycleCloudVnetName
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: addressPrefixes
    }
    subnets: [
      {
        name: cycleCloudSubnetName
        properties: {
          addressPrefix: cyclecloudSubnetPrefix
          serviceEndpoints: [
            {
              service: 'Microsoft.Storage'
              locations: ['*']
            }
            {
              service: 'Microsoft.keyvault'
              locations: ['*']
            }
          ] 
          //privateEndpointNetworkPolicies:'Disabled'
          //privateLinkServiceNetworkPolicies:'Disabled'
        }
      }
     ..

Setting the locations is something I would like to avoid, but while testing there was no difference.
Here are the 2 policy settings commented out, but putting them in, with enabled or disabled does not seem to make any difference.

what am I missing?

[ahelland]

Hmm... I don't remember if this is case-sensitive, but I think the proper casing is Microsoft.KeyVault for key vault.

[gevaertw]

I'm afraid that did not resolve the issue (I actually removed the key vault setting because I don't need it for now). The subnet gets deployed, no errors, no service endpoint...

digging a little deeper, I added

output vnetPropertiesOut_1 string = cycleCloudvNet_R.properties.subnets[0].properties.serviceEndpoints[0].service

when I get the output I get

{
  "type": "String",
  "value": "Microsoft.Storage"
}

So according to bicep this is deployed, Unfortunately portal says no. When exporting the ARM template it is not there either

[ahelland]

Interesting.

I sneak it in through a module like this:

snet.bicep

resource subnet 'Microsoft.Network/virtualNetworks/subnets@2023-05-01' = {
  name: '${vnetName}/${snetName}'
  properties: {
    addressPrefix: addressPrefix
    serviceEndpoints: empty(serviceEndpoints) ? [] : array(serviceEndpoints)
(...)
}

main.bicep

param serviceEndpointsCosmos object = {
  service: 'Microsoft.AzureCosmosDB'
  locations: [
    '*'
  ]
}

module snet 'snet.bicep' = {
  scope: rg_vnet
  name: 'snet'
  params: {
    vnetName: vnetName
    snetName: 'snet-${env}-cae'
    addressPrefix: snetPrefixCAE
    serviceEndpoints: serviceEndpointsCosmos
(...)
  }
}

But other than being a slightly different way of structuring things it should be pretty much what you are doing with your syntax.

[gevaertw]

I'll leave it for now, I was mixing up private endpoint with service endpoint, I need private endpoint for what I want to achieve, so 'im not longer digging into this..

[gevaertw]

For reference...

Whatever I did was correct, but later in the deployment there was a part that updated the properties of the subnet, effectively erasing the service endpoint again...

It seems that when updating the properties of a subnet it actually removes all properties not explicitly mentioned in the updated part...

[ahelland]

The devil is in the details :)

That is indeed how some Resource Providers work - some are additive and some replace/remove things you're not explicit about. Annoying but not a Bicep issue per se.