[AVM Module Issue]: Private endpoint resource_group_name in private_endpoints is ignored; PE is created in parent app resource group

[PbALpi7xEX]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Bug

(Optional) Module Version

0.22.0

(Optional) Correlation Id

No response

Description

When using Azure/avm-res-web-site/azurerm, setting private_endpoints..resource_group_name does not control where the private endpoint is created.
The private endpoint is created in the app resource group (derived from parent_id) instead of the specified resource group.

Repro configuration

The app is created under an app resource group via parent_id, while the private endpoint is configured with a different resource_group_name (network resource group).

Example:

    module "app_service" {
      source    = "Azure/avm-res-web-site/azurerm"
      version   = "0.22.0"

      name      = "example-app"
      location  = var.location
      parent_id = azurerm_resource_group.app.id

      private_endpoints_manage_dns_zone_group = false
      private_endpoints = {
        primary = {
          subnet_resource_id  = azurerm_subnet.private_endpoints.id
          resource_group_name = azurerm_resource_group.network.name
        }
      }
    }

Expected behavior

• Private endpoint should be created in the resource group specified by private_endpoints.primary.resource_group_name.

Actual behavior

• Private endpoint is created in the resource group associated with parent_id.

Impact

• Prevents common separation patterns where application resources and networking resources are managed in separate resource groups.
• Can violate policy/governance controls requiring private endpoints in a dedicated network RG.

Suspected root cause

PE creation appears to use the app parent scope for placement, and private_endpoints..resource_group_name is not honored for resource placement.

Workaround

• Create private endpoints outside the module (for example via azurerm_private_endpoint or azapi_resource) in the desired networking resource group.

Request

Please confirm whether this is:

• A bug (resource_group_name should be honored), or
• Intended behavior (documentation should clarify PE placement follows parent_id).

If bug, please update module behavior so private_endpoints..resource_group_name controls PE resource group placement.

[microsoft-github-policy-service]

Important

The "Needs: Triage 🔍" label must be removed once the triage process is complete!

Tip

For additional guidance on how to triage this issue/PR, see the Terraform Issue Triage documentation.