You did it wrong here:
principalId: aksCluster.identity.principalId
It is supposed to use kubelet identity instead of AKS Control Plane identity to access ACR.
See also: https://github.com/Azure/bicep/issues/4026