Core subnet route table associations are deleted on subsequent deploys

Versions affected

0.24 and higher

Steps to recreate

1. Deploy the TRE. Observe 6 of the core subnets having a route table association:

2. Run another deployment. Observe the core VNET being updated and replacing the subnets, and in doing so removing the route table association:

# module.network.azurerm_virtual_network.core will be updated in-place
  ~ resource "azurerm_virtual_network" "core" ***
[...]

           - ***
              - address_prefixes                              = [
                  - "10.1.1.0/24",
                ]
              - default_outbound_access_enabled               = true
              - delegation                                    = []
              - id                                            = "/subscriptions/XXX/resourceGroups/rg-***/providers/Microsoft.Network/virtualNetworks/vnet-***/subnets/SharedSubnet"
              - name                                          = "SharedSubnet"
              - private_endpoint_network_policies             = "Disabled"
              - private_link_service_network_policies_enabled = true
              - route_table_id                                = "/subscriptions/XXX/resourceGroups/rg-***/providers/Microsoft.Network/routeTables/rt-***"
              - security_group                                = "/subscriptions/XXX/resourceGroups/rg-***/providers/Microsoft.Network/networkSecurityGroups/nsg-default-rules"
              - service_endpoint_policy_ids                   = []
              - service_endpoints                             = []
            ***,

[...]

           + ***
              + address_prefixes                              = [
                  + "10.1.1.0/24",
                ]
              + default_outbound_access_enabled               = true
              + delegation                                    = []
              + id                                            = (known after apply)
              + name                                          = "SharedSubnet"
              + private_endpoint_network_policies             = "Disabled"
              + private_link_service_network_policies_enabled = true
              + security_group                                = "/subscriptions/XXX/resourceGroups/rg-***/providers/Microsoft.Network/networkSecurityGroups/nsg-default-rules"
              + service_endpoint_policy_ids                   = []
              + service_endpoints                             = []
                # (1 unchanged attribute hidden)
            ***,

3. Run a subsequent deploy. The route table associations are recreated.

4. Run a subsequent deploy. The route table associations are deleted.

5. And so on.

Root cause

The core subnets are defined inline with the core VNET. The subnet route table associations are then added as separate resources, which creates this issue: