ReferencedResourceNotProvisioned: DataPrivateSubnet is not in Succeeded state

[helendduncan]

✅ Checklist

• I have searched open and closed issues for duplicates.
• This is a problem observed when deploying a Data Safe Haven.
• I can reproduce this with the latest version.
• I have read through the documentation.
• This isn't an open-ended question (open a discussion if it is).

💻 System information

• Operating System:
• Data Safe Haven version: 5.0.1

📦 Packages

List of packages

Paste list of packages here

🚫 Describe the problem

🌳 Log messages

Relevant log messages

Diagnostics:                                                                                                                
  azure-native:network:PrivateEndpoint (sre_data_storage_account_data_private_sensitive_private_endpoint):                     
    error: 1 error occurred:                                                                                                 
        * Code="RetryableError" Message="A retryable error occurred." Details=[{"code":"ReferencedResourceNotProvisioned","message":"Cannot
proceed with operation because resource                                                                                                    
/subscriptions/07733781-3909-45a2-86f3-4f717505f4ef/resourceGroups/shm-prod5-sre-test-t2-hdl-rg/providers/Microsoft.Network/virtualNetworks
/shm-prod5-sre-test-t2-hdl-vnet/subnets/DataPrivateSubnet used by resource                                                                 
/subscriptions/07733781-3909-45a2-86f3-4f717505f4ef/resourceGroups/shm-prod5-sre-test-t2-hdl-rg/providers/Microsoft.Network/networkInterfac
es/shm-prod5-sre-test-t2-hdl-pep-storage-accou.nic.0d79bc26-0c85-47fc-9516-7c783a72c0b3 is not in Succeeded state. Resource is in Updating 
state and the last operation that updated/is updating the resource is PutSubnetOperation."}]                                               
                                                                                                                                           
  pulumi:pulumi:Stack (data-safe-haven-shm-prod5-sre-test-t2-hdl):                                                             
    WARNING: All log messages before absl::InitializeLog() is called are written to STDERR                                              
    I0000 00:00:1730196963.771893 16813007 fork_posix.cc:77] Other threads are currently calling into gRPC, skipping fork() handlers 
    I0000 00:00:1730196963.799456 16813007 fork_posix.cc:77] Other threads are currently calling into gRPC, skipping fork() handlers 
    I0000 00:00:1730197054.512867 16816138 fork_posix.cc:77] Other threads are currently calling into gRPC, skipping fork() handlers 
    I0000 00:00:1730197055.114869 16816138 fork_posix.cc:77] Other threads are currently calling into gRPC, skipping fork() handlers 
    I0000 00:00:1730197107.264491 16816138 fork_posix.cc:77] Other threads are currently calling into gRPC, skipping fork() handlers 
    I0000 00:00:1730197107.872033 16816138 fork_posix.cc:77] Other threads are currently calling into gRPC, skipping fork() handlers 
                                                                                                                                           
    error: update failed                                                                                                  
                                                                                                                                           
Resources:                                                                                                                  
    + 141 created                                                                                                               
                                                                                                                                           
Duration: 11m46s                                                                                                            
                                                                                                                                           
Pulumi error:  +  azure-native:network:PrivateEndpoint sre_data_storage_account_data_private_sensitive_private_endpoint      
creating (26s) error: 1 error occurred:                                                                        
Pulumi error:  +  azure-native:network:PrivateEndpoint sre_data_storage_account_data_private_sensitive_private_endpoint         
**creating failed** error: 1 error occurred:                                                                      
Pulumi error:  +  pulumi:pulumi:Stack data-safe-haven-shm-prod5-sre-test-t2-hdl creating (700s) error: 
update failed                                                                                                                     
Pulumi error:     error: 1 error occurred:                                                                                   
Pulumi error:     error: update failed                                                                                    
Pulumi error:  stderr:                                                                                                                     
Pulumi update failed.                                                                                                                      
Pulumi deployment failed.                                                                                                                  
Could not deploy Secure Research Environment 'test_t2_hdl'.     

♻️ To reproduce

[JimMadge]

Looks like a race condition. Pulumi doesn't know that the private endpoint depends on the subnet.

Likely fix is adding a depends_on.