azapi_update_resource : issue in updating the resource (AKS etag mismatch)

We have created a AKS cluster using azurerm provider. We have used azapi_update_resource to add customCA to this AKS cluster.

However, when we are running terraform apply, the azapi_update_resource immediately tries to update the AKS and throws the following Etag mismatch error.

╷
│ Error: Failed to update resource
│
│ with module.aks.azapi_update_resource.aks,
│ on ../modules/az/aks/main.tf line 50, in resource "azapi_update_resource" "aks":
│ 50: resource "azapi_update_resource" "aks" {
│
│ updating "Resource: (ResourceId
│ \"/subscriptions/xxxxxxx/resourceGroups/test-rg/providers/Microsoft.ContainerService/managedClusters/test-aks-cluster\"
│ / Api Version \"2024-10-02-preview\")": PUT
│ https://management.azure.com/subscriptions/xxxxxxxxxx/resourceGroups/test-rg/providers/Microsoft.ContainerService/managedClusters/test-aks-cluster
│ --------------------------------------------------------------------------------
│ RESPONSE 409: 409 Conflict
│ ERROR CODE: EtagMismatch
│ --------------------------------------------------------------------------------
│ {
│ "code": "EtagMismatch",
│ "details": [
│ {
│ "code": "Unspecified",
│ "message": "rpc error: code = FailedPrecondition desc = Etag mismatched"
│ }
│ ],
│ "message": "Operation is not allowed: Another operation is in progress",
│ "subcode": "PutManagedClusterAndComponents_FailedPrecondition_HCPServerError"
│ }
│ --------------------------------------------------------------------------------
│

Code for azapi_update_resource is as below:

resource "azapi_update_resource" "aks" {
type = "Microsoft.ContainerService/managedClusters@2024-10-02-preview"
resource_id = azurerm_kubernetes_cluster.aks[0].id
locks = [azurerm_kubernetes_cluster.aks[0].id]

body = {
properties = {
agentPoolProfiles = [{
name = "system"
enableCustomCATrust = true
}]
securityProfile = {
customCATrustCertificates = [filebase64("${path.module}/root-ca.cer")]
}
}
}
depends_on = [azurerm_kubernetes_cluster.aks, time_sleep.wait_for_aks]
}

One of the solution, I tried was adding time_sleep.wait_for_aks, pipeline runs successfully during the creation of time_sleep resource, however fails to wait for 60 seconds from 2nd attempt.

The azapi provider version used is 2.3.0
The azurerm provider version used is 4.26.0