feat: avm/ptn/ai-platform/baseline Change VNet to use subnets child…

… resource (#3054)

## Description

<!--
>Thank you for your contribution !
> Please include a summary of the change and which issue is fixed.
> Please also include the context.
> List any dependencies that are required for this change.

Fixes #123
Fixes #456
Closes #123
Closes #456
-->

Changes the VNet to use child resources to create subnets, instead of
the AVM module. Without this change, it is not possible to create
subnets from outside of the module, as any subnets not defined in the
`subnets` property get deleted the next time the module is deployed.

## Pipeline Reference

<!-- Insert your Pipeline Status Badge below -->

| Pipeline |
| -------- |
|
[![avm.ptn.ai-platform.baseline](https://github.com/cecheta/bicep-registry-modules/actions/workflows/avm.ptn.ai-platform.baseline.yml/badge.svg?branch=vnet)](https://github.com/cecheta/bicep-registry-modules/actions/workflows/avm.ptn.ai-platform.baseline.yml)
|

## Type of Change

<!-- Use the checkboxes [x] on the options that are relevant. -->

- [ ] Update to CI Environment or utilities (Non-module affecting
changes)
- [x] Azure Verified Module updates:
- [ ] Bugfix containing backwards-compatible bug fixes, and I have NOT
bumped the MAJOR or MINOR version in `version.json`:
- [ ] Someone has opened a bug report issue, and I have included "Closes
#{bug_report_issue_number}" in the PR description.
- [ ] The bug was found by the module author, and no one has opened an
issue to report it yet.
- [ ] Feature update backwards compatible feature updates, and I have
bumped the MINOR version in `version.json`.
- [x] Breaking changes and I have bumped the MAJOR version in
`version.json`.
  - [ ] Update to documentation

## Checklist

- [x] I'm sure there are no other open Pull Requests for the same
update/change
- [x] I have run `Set-AVMModule` locally to generate the supporting
module files.
- [ ] My corresponding pipelines / checks run clean and green without
any errors or warnings

<!-- Please keep up to date with the contribution guide at
https://aka.ms/avm/contribute/bicep -->

avm/ptn/ai-platform/baseline/README.md

@@ -54,12 +54,11 @@ By integrating with Microsoft Entra ID for secure identity management and utiliz
 | `Microsoft.Network/privateDnsZones/virtualNetworkLinks` | [2020-06-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2020-06-01/privateDnsZones/virtualNetworkLinks) |
 | `Microsoft.Network/privateEndpoints` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints) |
 | `Microsoft.Network/privateEndpoints` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints) |
-| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
 | `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/privateEndpoints/privateDnsZoneGroups) |
+| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/privateEndpoints/privateDnsZoneGroups) |
 | `Microsoft.Network/publicIPAddresses` | [2023-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-09-01/publicIPAddresses) |
-| `Microsoft.Network/virtualNetworks` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/virtualNetworks) |
-| `Microsoft.Network/virtualNetworks/subnets` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/virtualNetworks/subnets) |
-| `Microsoft.Network/virtualNetworks/virtualNetworkPeerings` | [2023-11-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-11-01/virtualNetworks/virtualNetworkPeerings) |
+| `Microsoft.Network/virtualNetworks` | [2024-01-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/virtualNetworks) |
+| `Microsoft.Network/virtualNetworks/subnets` | [2024-01-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/virtualNetworks/subnets) |
 | `Microsoft.OperationalInsights/workspaces` | [2023-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.OperationalInsights/2023-09-01/workspaces) |
 | `Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems` | [2023-01-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.RecoveryServices/2023-01-01/vaults/backupFabrics/protectionContainers/protectedItems) |
 | `Microsoft.Storage/storageAccounts` | [2022-09-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Storage/2022-09-01/storageAccounts) |
@@ -1183,7 +1182,6 @@ This section gives you an overview of all local-referenced module files (i.e., o
 | `br/public:avm/res/network/bastion-host:0.2.2` | Remote reference |
 | `br/public:avm/res/network/network-security-group:0.3.1` | Remote reference |
 | `br/public:avm/res/network/private-dns-zone:0.3.1` | Remote reference |
-| `br/public:avm/res/network/virtual-network:0.1.8` | Remote reference |
 | `br/public:avm/res/storage/storage-account:0.11.0` | Remote reference |
 
 ## Data Collection

avm/ptn/ai-platform/baseline/main.bicep

@@ -59,7 +59,7 @@ var createVirtualMachine = createVirtualNetwork && virtualMachineConfiguration.?
 
 var createDefaultNsg = virtualNetworkConfiguration.?subnet.networkSecurityGroupResourceId == null
 
-var subnetResourceId = createVirtualNetwork ? virtualNetwork.outputs.subnetResourceIds[0] : null
+var subnetResourceId = createVirtualNetwork ? virtualNetwork::defaultSubnet.id : null
 
 var mlTargetSubResource = 'amlworkspace'
 
@@ -103,7 +103,7 @@ module storageAccount_privateDnsZones 'br/public:avm/res/network/private-dns-zon
       name: zone
       virtualNetworkLinks: [
         {
-          virtualNetworkResourceId: virtualNetwork.outputs.resourceId
+          virtualNetworkResourceId: virtualNetwork.id
         }
       ]
     }
@@ -117,7 +117,7 @@ module workspaceHub_privateDnsZones 'br/public:avm/res/network/private-dns-zone:
       name: zone
       virtualNetworkLinks: [
         {
-          virtualNetworkResourceId: virtualNetwork.outputs.resourceId
+          virtualNetworkResourceId: virtualNetwork.id
         }
       ]
       roleAssignments: [
@@ -158,36 +158,47 @@ module defaultNetworkSecurityGroup 'br/public:avm/res/network/network-security-g
   }
 }
 
-module virtualNetwork 'br/public:avm/res/network/virtual-network:0.1.8' = if (createVirtualNetwork) {
-  name: '${uniqueString(deployment().name, location)}-virtual-network'
-  params: {
-    name: virtualNetworkConfiguration.?name ?? 'vnet-${name}'
-    location: location
-    enableTelemetry: enableTelemetry
-    addressPrefixes: [
-      virtualNetworkConfiguration.?addressPrefix ?? '10.0.0.0/16'
+// Not using the br/public:avm/res/network/virtual-network module here to
+// allow consumers of the module to add subnets from outside of the module
+// https://github.com/Azure/bicep-registry-modules/issues/2689
+resource virtualNetwork 'Microsoft.Network/virtualNetworks@2024-01-01' = if (createVirtualNetwork) {
+  name: virtualNetworkConfiguration.?name ?? 'vnet-${name}'
+  location: location
+  tags: tags
+  properties: {
+    addressSpace: {
+      addressPrefixes: [
+        virtualNetworkConfiguration.?addressPrefix ?? '10.0.0.0/16'
+      ]
+    }
+  }
+
+  resource defaultSubnet 'subnets@2024-01-01' = {
+    name: virtualNetworkConfiguration.?subnet.name ?? 'default'
+    properties: {
+      addressPrefix: virtualNetworkConfiguration.?subnet.addressPrefix ?? '10.0.0.0/24'
+      networkSecurityGroup: {
+        id: createDefaultNsg
+          ? defaultNetworkSecurityGroup.outputs.resourceId
+          : virtualNetworkConfiguration.?subnet.networkSecurityGroupResourceId
+      }
+    }
+  }
+
+  resource bastionSubnet 'subnets@2024-01-01' = if (createBastion) {
+    name: 'AzureBastionSubnet'
+    properties: {
+      addressPrefix: bastionConfiguration.?subnetAddressPrefix ?? '10.0.1.0/26'
+      networkSecurityGroup: bastionConfiguration.?networkSecurityGroupResourceId != null
+        ? {
+            id: bastionConfiguration.?networkSecurityGroupResourceId
+          }
+        : null
+    }
+
+    dependsOn: [
+      defaultSubnet
     ]
-    subnets: union(
-      [
-        {
-          addressPrefix: virtualNetworkConfiguration.?subnet.addressPrefix ?? '10.0.0.0/24'
-          name: virtualNetworkConfiguration.?subnet.name ?? 'default'
-          networkSecurityGroupResourceId: createDefaultNsg
-            ? defaultNetworkSecurityGroup.outputs.resourceId
-            : virtualNetworkConfiguration.?subnet.networkSecurityGroupResourceId
-        }
-      ],
-      createBastion
-        ? [
-            {
-              addressPrefix: bastionConfiguration.?subnetAddressPrefix ?? '10.0.1.0/26'
-              name: 'AzureBastionSubnet'
-              networkSecurityGroupResourceId: bastionConfiguration.?networkSecurityGroupResourceId
-            }
-          ]
-        : []
-    )
-    tags: tags
   }
 }
 
@@ -198,7 +209,7 @@ module bastion 'br/public:avm/res/network/bastion-host:0.2.2' = if (createBastio
     location: location
     skuName: bastionConfiguration.?sku ?? 'Standard'
     enableTelemetry: enableTelemetry
-    virtualNetworkResourceId: virtualNetwork.outputs.resourceId
+    virtualNetworkResourceId: virtualNetwork.id
     disableCopyPaste: bastionConfiguration.?disableCopyPaste
     enableFileCopy: bastionConfiguration.?enableFileCopy
     enableIpConnect: bastionConfiguration.?enableIpConnect
@@ -227,7 +238,7 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.5.3' = if (cr
           {
             name: virtualMachineConfiguration.?nicConfigurationConfiguration.ipConfigName ?? 'nic-vm-${name}-ipconfig'
             privateIPAllocationMethod: virtualMachineConfiguration.?nicConfigurationConfiguration.privateIPAllocationMethod ?? 'Dynamic'
-            subnetResourceId: virtualNetwork.outputs.subnetResourceIds[0]
+            subnetResourceId: virtualNetwork::defaultSubnet.id
           }
         ]
       }
@@ -370,7 +381,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.11.0' = {
           name: 'pep-${zone.value}-${name}'
           customNetworkInterfaceName: 'nic-${zone.value}-${name}'
           service: zone.value
-          subnetResourceId: subnetResourceId
+          subnetResourceId: subnetResourceId ?? ''
           privateDnsZoneResourceIds: [resourceId('Microsoft.Network/privateDnsZones', zone.key)]
         })
       : null
@@ -515,7 +526,7 @@ module workspaceHub 'br/public:avm/res/machine-learning-services/workspace:0.5.0
             name: 'pep-${mlTargetSubResource}-${name}'
             customNetworkInterfaceName: 'nic-${mlTargetSubResource}-${name}'
             service: mlTargetSubResource
-            subnetResourceId: subnetResourceId
+            subnetResourceId: subnetResourceId ?? ''
             privateDnsZoneGroup: {
               privateDnsZoneGroupConfigs: map(objectKeys(mlPrivateDnsZones), zone => {
                 name: replace(zone, '.', '-')
@@ -659,16 +670,16 @@ output workspaceProjectResourceId string = workspaceProject.outputs.resourceId
 output workspaceProjectName string = workspaceProject.outputs.name
 
 @description('The resource ID of the virtual network.')
-output virtualNetworkResourceId string = createVirtualNetwork ? virtualNetwork.outputs.resourceId : ''
+output virtualNetworkResourceId string = createVirtualNetwork ? virtualNetwork.id : ''
 
 @description('The name of the virtual network.')
-output virtualNetworkName string = createVirtualNetwork ? virtualNetwork.outputs.name : ''
+output virtualNetworkName string = createVirtualNetwork ? virtualNetwork.name : ''
 
 @description('The resource ID of the subnet in the virtual network.')
-output virtualNetworkSubnetResourceId string = createVirtualNetwork ? virtualNetwork.outputs.subnetResourceIds[0] : ''
+output virtualNetworkSubnetResourceId string = createVirtualNetwork ? virtualNetwork::defaultSubnet.id : ''
 
 @description('The name of the subnet in the virtual network.')
-output virtualNetworkSubnetName string = createVirtualNetwork ? virtualNetwork.outputs.subnetNames[0] : ''
+output virtualNetworkSubnetName string = createVirtualNetwork ? virtualNetwork::defaultSubnet.name : ''
 
 @description('The resource ID of the Azure Bastion host.')
 output bastionResourceId string = createBastion ? bastion.outputs.resourceId : ''