Pulumi azure-native missing required property 'resourceGroupName'

in a pulumi script i get the following error running pulumi up

azure-native:sql:DatabaseSecurityAlertPolicy (sap_primary):
    error: azure-native:sql:DatabaseSecurityAlertPolicy resource 'sap_primary' has a problem: missing required property 'resourceGroupName'

Here is the relevant part of the code:

resource_group = resources.ResourceGroup(
    resource_name = <rg-name>,
    tags={
        <tags> # placeholder for the real tags
    },
    opts=pulumi.ResourceOptions(import_=<rg id>))


sql_server = sql.Server(
    resource_name                   = str(app_stage) + '-' + str(app_key) + '-sql',
    resource_group_name             = resource_group.name,
    location                        = resource_group.location,
    administrator_login             = sql_server_admin_user,
    administrator_login_password    = sql_server_admin_password,
    version                         = sql_version,
    tags                            = resource_group.tags,
    identity                        = sql.ResourceIdentityArgs(type=sql.IdentityType.SYSTEM_ASSIGNED)
)


sql_database_primary = sql.Database(
    resource_name                   = sql_database_name,
    resource_group_name             = resource_group.name,
    location                        = resource_group.location,
    server_name                     = sql_server.name,
    sku                             = sql.SkuArgs(
        name = 'GP_Gen5_2',
        tier = sql_edition),
    zone_redundant                  = sql_zone_redundancy, 
    tags                            = resource_group.tags,
)

database_security_alert_policy  = sql.DatabaseSecurityAlertPolicy(
        resource_name       = 'sap_primary',
        resource_group_name = sql_server.resource_group_name, 
        database_name       = sql_database_name,
        server_name         = sql_server.name,
        state               = sql.SecurityAlertsPolicyState.ENABLED,
    )

I don't understand why does it say resourceGroupName is missing but it is set as you can see. What am I missing?

To avoid questions like: Where is e.g. sql_server_admin_user coming from, they are set in the Pulumi.dev.yaml file and imported in the script like config.get('sql_server_admin_user')

sql_server.resource_group_name does not exist. Use resource_group.name instead.