Conditional deployment of Virtual Network Links does not work

[JLunda]

Bicep version
0.12.40

Describe the bug
Resource of type Microsoft.Network/privateDnsZones/virtualNetworkLinks does not respect conditional deployment.

To Reproduce
Background: I have a module for creating virtual network links on a Private DNS Zone for various resources, e.g. storage services (blob, file, etc.), Cosmos DB (documents), and Function Apps (sites). Taking just one virtual network link for blob service as an example, the following components should not allow the virtual network link to be deployed, but the deployment is errantly attempted.

// Virtual network of the network to be linked to the Private DNS Zone.
param virtualNetworkName string
param virtualNetworkId string

param blobPrivateDnsZoneName string = ''

var stgAcctPrivateDnsZoneVnetLinkName = 'link-${virtualNetworkName}-to-dns-st'
var blobDnsNameIsNotEmpty = !empty(blobPrivateDnsZoneName)

resource blobPrivateDnsZoneVnetLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = if (blobDnsNameIsNotEmpty) {
  name: blobDnsNameIsNotEmpty ? '${blobPrivateDnsZoneName}/${stgAcctPrivateDnsZoneVnetLinkName}' : ''
  location: 'global'
  properties: {
    registrationEnabled: false
    virtualNetwork: {
      id: blobDnsNameIsNotEmpty ? virtualNetworkId : ''
    }
  }
}

In the event that I DO NOT pass a name in for blobPrivateDnsZoneName, blobDnsNameIsNotEmpty correctly returns False, but creation of the virtualNetworkLink resource is still attempted with an empty string for the name. The error from Azure/ARM is:

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"InvalidTemplate","message":"Deployment template validation failed: 'The template resource '' of type 'Microsoft.Network/privateDnsZones/virtualNetworkLinks' at line '1' and column '4016' is not valid. The name property cannot be null or empty. Please see https://aka.ms/arm-template/#resources for usage details.'."}]}

However, the validation pass should not take a look at the virtual network link, as I have it marked conditional AND I have ternary conditional safety on the virtual network ID parameter.

Additional Context
The Private DNS Zones already exist in a separate resource group and this virtual network links module is called within the scope of that other resource group.

[StefanIvemo]

The issue that you are bumping into here is that ARM is validating the name of the resource even though you're doing a conditional deployment.

When blobDnsNameIsNotEmpty returns false the name property for the virtualNetworkLinks resource is '' and this is what ARM is rejecting. You can provide a dummy name in your condition instead of '' as a workaround. But since you are deploying a child resource with segmented names and your condition is to check if a parameter with the DNS Zone name is empty you need to use a dummy name for the first segment as well or we would get an error that the number of segments are incorrect.

Here's an example that would work for you:

// Virtual network of the network to be linked to the Private DNS Zone.
param virtualNetworkName string = ''
param virtualNetworkId string = ''

param blobPrivateDnsZoneName string = ''

var stgAcctPrivateDnsZoneVnetLinkName = 'link-${virtualNetworkName}-to-dns-st'
var blobDnsNameIsNotEmpty = !empty(blobPrivateDnsZoneName)

resource privateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' existing = {
  name: blobDnsNameIsNotEmpty ? blobPrivateDnsZoneName : 'dummy.com'
}

resource blobPrivateDnsZoneVnetLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = if (blobDnsNameIsNotEmpty) {
  name: blobDnsNameIsNotEmpty ? stgAcctPrivateDnsZoneVnetLinkName : 'dummy'
  parent: privateDnsZone
  location: 'global'
  properties: {
    registrationEnabled: false
    virtualNetwork: {
      id: blobDnsNameIsNotEmpty ? virtualNetworkId : ''
    }
  }
}