Compute Instance with no Public IP fails to provision

[RoozbehBandpey]

Context (Environment)

I'm trying to manually create a compute instance with no public IP address (since it's not possible to do it with Terraform). After setting up a private Azure ML workspace following this template 201-machine-learning-moderately-secure

Terraform (and AzureRM Provider) Version

terraform v0.14.0
azurerm v2.96.0

Current Behavior

Provisioning fails with this error:

Provisioning error
The specified subnet /subscriptions/[REDACTED]/resourceGroups/[REDACTED]/providers/Microsoft.Network/virtualNetworks/[REDACTED]/subnets/snet-training-dev-westeurope has PrivateLinkServiceNetworkPolicies or PrivateEndpointNetworkPolicies enabled. Please disable them to provision cluster/instance with no public IP. Please read this document for more details: https://aka.ms/AMLPLNetPolicies

Provisioning Compute Instance with public IP address completes successfully.

Possible Solution

I have tried every combination of PrivateLinkServiceNetworkPolicies or PrivateEndpointNetworkPolicies on the training subnet. No luck!

Here's my training Subnet block

resource "azurerm_subnet" "snet_training" {
  name                                            = "snet-training-${var.deploy_target}-${var.machine_learning_location}"
  resource_group_name                             = data.azurerm_virtual_network.existing_mlw_vnet.resource_group_name
  virtual_network_name                            = data.azurerm_virtual_network.existing_mlw_vnet.name
  address_prefixes                                = var.snet_training_addr_prefixes
  enforce_private_link_endpoint_network_policies  = true 
  enforce_private_link_service_network_policies   = false 
}

Steps to Reproduce

1. 201-machine-learning-moderately-secure

[vrugelda]

Did you solve this issue?

I'm deploying the same as you and hitting a couple of errors. Most likely network related.
As of now I'm not deploying with this No Public IP option..
When I'm trying to connect to a notebook from an instance (logged on to the Jumpbox) - it complains about Kernel error and network. (even access as well)

Could this be related to the same policies.. ?

Any tip would be helpful