Command syntax issue with Terraform null provider

Objective: Trying to run multiple AZcli commands within Null provider resource definition in terraform. Trying to list all private endpoints, then loop through it for finding all private endpoints which has status of "pending" and then approve those.

My current code:

  resource "null_resource" "endpoint_approval" {
  depends_on = [azurerm_synapse_managed_private_endpoint.mpe_adls_blob]

  provisioner "local-exec" {
    command = <<EOT
      pending_endpoints=$(az network private-endpoint-connection list --id "${var.syn_adls_id}" --query "[?properties.privateLinkServiceConnectionState.status=='Pending'].id" -o tsv)
      for each_endpoint in $pending_endpoints
      do
        az network private-endpoint-connection approve --id "$each_endpoint" --description "Approved in Terraform"
      done
    EOT
    interpreter = ["/bin/bash", "-c"]
  }
}

Error I get:

 ': exit status 2. Output: /bin/sh: syntax error: unexpected end of file (expecting "done")

I have verified indents line by line, seems to be fine, and also used terraform fmt command to format it before I execute, but I am clueless why I am getting this error. Can someone guide me ? Thanks in advance

I tried resolving the Syntax issue by using the code below and got the output without any errors:-

My main.tf code:-

I have referred the code from this official Terraform document and modified it with null resource block and my variables

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "~>3.0"
    }
  }
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "example-resources-siliconrg"
  location = "West Europe"
}

resource "azurerm_storage_account" "example" {
  name                     = "siliconstrgacc"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  account_kind             = "StorageV2"
  is_hns_enabled           = "true"
  depends_on = [ azurerm_resource_group.example ]
}

resource "azurerm_storage_data_lake_gen2_filesystem" "example" {
  name               = "example-siliconadls2"
  storage_account_id = azurerm_storage_account.example.id
  depends_on = [ azurerm_storage_account.example ]
}

resource "azurerm_synapse_workspace" "example" {
  name                                 = "example-siliconsy32"
  resource_group_name                  = azurerm_resource_group.example.name
  location                             = azurerm_resource_group.example.location
  storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id
  sql_administrator_login              = "enter_your_user"
  sql_administrator_login_password     = "enter_your_password"
  managed_virtual_network_enabled      = true
  depends_on = [ azurerm_storage_account.example ]

  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_synapse_firewall_rule" "example" {
  name                 = "AllowAll"
  synapse_workspace_id = azurerm_synapse_workspace.example.id
  start_ip_address     = "0.0.0.0"
  end_ip_address       = "255.255.255.255"
  depends_on = [ azurerm_synapse_workspace.example ]
}

resource "azurerm_storage_account" "example_connect" {
  name                     = "siliconstrg54"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  account_kind             = "BlobStorage"
  depends_on = [ azurerm_synapse_workspace.example ]
}

resource "azurerm_synapse_managed_private_endpoint" "example" {
  name                 = "example-endpoint-silion32"
  synapse_workspace_id = azurerm_synapse_workspace.example.id
  target_resource_id   = azurerm_storage_account.example_connect.id
  subresource_name     = "blob"

  depends_on = [azurerm_synapse_firewall_rule.example]
}

resource "null_resource" "resourcecli" {
  provisioner "local-exec" {
    command = <<EOT
      $pending_endpoints = $(az network private-endpoint-connection list --id "${azurerm_storage_data_lake_gen2_filesystem.example.id}" --query "[?properties.privateLinkServiceConnectionState.status=='Pending'].id" -o tsv)
      foreach ($each_endpoint in $pending_endpoints) {
        az network private-endpoint-connection approve --id $each_endpoint --description "Approved in Terraform"
      }
    EOT
    interpreter = ["PowerShell", "-Command"]
  }
}

Output:-

https://i.imgur.com/xZFxvDv.png

https://i.imgur.com/dR7FFOq.png