Cannot apply tags to private DNS zones if keys contain whitespace

[Gabe-Kelly01]

I stumbled upon this issue while trying to apply tags on private DNS zones via Terraform, but I have determined that it is an issue with the ARM API itself. When applying tags to any private DNS zone resource, tags will not be applied if the tag's key contains whitespace.

Steps to reproduce

> curl --location 
--request PATCH 'https://management.azure.com/subscriptions/••••••/resourceGroups/••••••/providers/Microsoft.Network/privateDnsZones/foo.test.org?api-version=2018-09-01' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
  "tags": {
    "Application": "ARM API Test",
    "Application Owner": "Cloud Engineering Team"
  }
}'
> 202 Accepted

Expected outcome

Running the GET method on the same endpoint should show both of those tags:

> curl --location 
'https://management.azure.com/subscriptions/••••••/resourceGroups/••••••/providers/Microsoft.Network/privateDnsZones/foo.test.org?api-version=2018-09-01' \
--header 'Authorization: ••••••'
> {
    "id": "/subscriptions/••••••/resourceGroups/••••••/providers/Microsoft.Network/privateDnsZones/foo.test.org",
    "name": "foo.test.org",
    "type": "Microsoft.Network/privateDnsZones",
    "etag": "••••••",
    "location": "global",
    "tags": {
        "Application": "ARM API Test",
        "Application Owner": "Cloud Engineering Team"
    },
    "properties": {
        "maxNumberOfRecordSets": 25000,
        "maxNumberOfVirtualNetworkLinks": 1000,
        "maxNumberOfVirtualNetworkLinksWithRegistration": 100,
        "numberOfRecordSets": 1,
        "numberOfVirtualNetworkLinks": 0,
        "numberOfVirtualNetworkLinksWithRegistration": 0,
        "provisioningState": "Succeeded"
    }
}

Actual outcome

In reality, this is the output I get from that request:

> curl --location 
'https://management.azure.com/subscriptions/••••••/resourceGroups/••••••/providers/Microsoft.Network/privateDnsZones/foo.test.org?api-version=2018-09-01' \
--header 'Authorization: ••••••'
> {
    "id": "/subscriptions/••••••/resourceGroups/••••••/providers/Microsoft.Network/privateDnsZones/foo.test.org",
    "name": "foo.test.org",
    "type": "Microsoft.Network/privateDnsZones",
    "etag": "••••••",
    "location": "global",
    "tags": {
        "Application": "ARM API Test"
    },
    "properties": {
        "maxNumberOfRecordSets": 25000,
        "maxNumberOfVirtualNetworkLinks": 1000,
        "maxNumberOfVirtualNetworkLinksWithRegistration": 100,
        "numberOfRecordSets": 1,
        "numberOfVirtualNetworkLinks": 0,
        "numberOfVirtualNetworkLinksWithRegistration": 0,
        "provisioningState": "Succeeded"
    }
}

Additional info

I tested this with 2 API versions, 2018-09-01 and 2024-06-01, which according to the documentation are the oldest and newest supported versions of the API for this resource type. I discovered this bug using Terraform v1.5.5 and azurerm v4.18.0. Please note that this bug has been cropping up with Terraform users as far back as 2020.

[Gabe-Kelly01]

One more thing to note, after talking to other people who have had this issue it appears that keys containing colons have the same problem with this resource type.