Cloud Assembly Cloud Template not picking up Image Cloud Configuration

[evil242]

Hello,

My institution has some specific requirements around OS deployment, for example windows OS goes on Windows tagged datastore clusters.  I got that working through Cloud_vSphere_Machine: stanza.  But then I thought, what if I could get that information to stay with the Cloud Configuration under the Image.  

My Design Template is as follows

formatVersion: 1
resources:
   Cloud_vSphere_Machine_1:
   type: Cloud.vSphere.Machine
   properties:
      Infoblox.IPAM.Network.dnsView: Internal
      image: DevWinServ2019
      folderName: ${"vRA_Deployed/" + env.projectName}
      networks:
        - network: ${resource.Cloud_NSX_Network_1.id}
          assignment: static
          securityGroups: []
      flavor: base-dev
      tags:
        - key: OS
          value: Windows
      constraints:
        - tag: OS:Windows
      storage:
        constraints:
          - tag: StorageOS:Windows
          - tag: StoragePurpose:Primary
         maxDiskCapacityInGB: 1
         bootDiskCapacityInGB: 1
 Cloud_NSX_Network_1:
    type: Cloud.NSX.Network
    properties:
       networkType: existing
       constraints:
          - tag: OS:Windows

And my image Cloud Configuration:

resources:
   properties:
      customizationSpec: Org_DomainJoin
      tags:
        - key: nsxSecurityTag
        - value: WindowsAdmin-Managed

I'm getting my project specific nsxSecurityTag's imported from my project. But I can't seem to get this one tag imported from the image.  If I put this tag in the resources stanza of the Design Template, it works.  As you see, I have some very windows centered configurations I'd like to move into the image Cloud Configuration.  But I'm not moving it until I can see this nsxSecurityTag imported/merged into the design blueprint deployment. 

Documentation only got me so far.  Any suggestions to what I am doing wrong in the Cloud Configuration?