BMSUserErrorInvalidInput in az dataprotection backup-instance adhoc-backup for Kubernetes Service

[m-cappi]

Describe the bug

I am using Azure Kubernetes Service and Azure Backup Vault to generate regular backups of my cluster.  

I am now trying to script the creation of an On-demand backup using Azure CLI. However, after thoroughly validating all inputs, I keep getting a BMSUserErrorInvalidInput. Using Az-PowerShell and the REST API led to similar results, even when it works correctly whenever I trigger it from the portal.

Related command

az dataprotection backup-instance adhoc-backup --rule-name "Default" -n $BACKUP_INSTANCE_NAME -g $RESOURCE_GROUP_NAME --subscription $SUBSCRIPTION_ID -v $BACKUP_VAULT_NAME

Errors

(BMSUserErrorInvalidInput)  The user's input for the call is incorrect
Code: BMSUserErrorInvalidInput
Message:  The user's input for the call is incorrect
Additional Information:Type: UserFacingError
Info: {
    "message": " The user's input for the call is incorrect",
    "recommendedAction": [
        "Please check the required inputs"
    ],
    "code": "BMSUserErrorInvalidInput",
    "target": "",
    "isRetryable": false,
    "isUserError": false,
    "properties": {
        "ActivityId": "xxx-xxx-xxx-xxx-xxx"
    }
}

Issue script & Debug output

(Tomorrow I will update with the debug logs because I'm now getting this error The operation is blocked, as a security precaution, since multiple attempts were made beyond an internal limit.)

Expected behavior

Successfully triggers and creates an Azure Kubernetes Service backup, which works fine when triggered from the portal.

Environment Summary

{
  "azure-cli": "2.60.0",
  "azure-cli-core": "2.60.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {
    "account": "0.2.5",
    "azure-iot": "0.17.0",
    "dataprotection": "1.4.0"
  }
}

Additional context

resource "azurerm_data_protection_backup_policy_kubernetes_cluster" "this" {
  name                = "bup-pol-${var.environment}-${var.location}"
  resource_group_name = var.resource_group_name
  vault_name          = azurerm_data_protection_backup_vault.this.name

  backup_repeating_time_intervals = ["R/2024-04-24T05:00:00+00:00/P1D"]

  retention_rule {
    name     = "Custom"
    priority = 25

    life_cycle {
      duration        = "P14D"
      data_store_type = "OperationalStore"
    }

    criteria {
      absolute_criteria = "FirstOfDay"
    }
  }

  default_retention_rule {
    life_cycle {
      duration        = "P360D"
      data_store_type = "OperationalStore"
    }
  }
}