Passing secure parameter to PowerShell DSC script from Bicep template - powershell

Question

I am using a Bicep template to deploy a virtual machine with a PowerShell DSC script that adds a Log Analytics workspace to the Log Analytics agent. The script uses a secure parameter (workspaceKey1) which is defined in the template and pulled from a key vault. When running the script, I'm getting the following error:
" Performing the operation "Set-TargetResource" on target "Executing the SetScript with the user supplied credential"."},
PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: Value does not fall within the expected range."
A simplified version of the script is below.
Configuration MmaMultihoming
{
Param (
[string] $workspaceId1,
[System.Management.Automation.PSCredential] $workspaceKey1,
)
Import-DscResource -ModuleName PSDesiredStateConfiguration;
Import-DscResource -ModuleName xPSDesiredStateConfiguration;
[System.Management.Automation.PSCredential]$workspaceKey1 = New-Object System.Management.Automation.PSCredential ($workspaceKey1.userName, $workspaceKey1.password)
Node localhost {
Script ConfigureWorkspace
{
SetScript =
{
$workspaceId = $Using:workspaceId1;
$workspaceKey = $Using:workspaceKey1;
$mma = New-Object -ComObject 'AgentConfigManager.MgmtSvcCfg';
$mma.AddCloudWorkspace($workspaceId, $workspaceKey);
$mma.ReloadConfiguration();
}
TestScript = { Test-Path "HKLM:\SYSTEM\ControlSet001\Services\HealthService\Parameters\Service Connector Services\Log Analytics - $($Using:workspaceId)"}
GetScript = { #{ Result = (Get-ChildItem "HKLM:\SYSTEM\ControlSet001\Services\HealthService\Parameters\Service Connector Services")} }
}
}
}
The Bicep code is below:
param keyvaultName string = 'keyvault'
param kvResourceGroup string = 'keyvault-rg'
param workspaceId1 string
#secure()
param workspaceKey1 string = kv.getSecret('workspaceKey1')
resource kv 'Microsoft.KeyVault/vaults#2022-07-01' existing = {
name: keyvaultName
scope: resourceGroup(kvResourceGroup )
}
resource DSC_LogAnalytics 'Microsoft.Compute/virtualMachines/extensions#2022-08-01' = {
parent: vm1
name: 'Microsoft.Powershell.DSC'
location: location
properties: {
publisher: 'Microsoft.PowerShell'
type: 'DSC'
typeHandlerVersion: '2.77'
autoUpgradeMinorVersion: true
settings: {
wmfVersion: 'latest'
configuration: {
url: dscScript
script: 'dsc.ps1'
function: 'MmaMultihoming'
}
configurationArguments: {
workspaceId1: workspaceId1
}
privacy: {
datacollection: 'enable'
}
advancedOptions: {
forcePullAndApply: false
}
}
protectedSettings: {
configurationArguments: {
workspaceKey1: {
userName: 'donotuse'
password: workspaceKey1
}
}
configurationUrlSasToken: SaaStoken
}
}
}
I am really quite stuck so would appreciate any ideas people can give.
Thanks!