Attach virtual network to storage (#1065)

Author: msebragge

templates/workspaces/base/terraform/network.tf

@@ -13,6 +13,7 @@ resource "azurerm_subnet" "services" {
   virtual_network_name = azurerm_virtual_network.ws.name
   resource_group_name  = azurerm_resource_group.ws.name
   address_prefixes     = [local.services_subnet_address_prefix]
+  service_endpoints    = ["Microsoft.Storage"]
   # notice that private endpoints do not adhere to NSG rules
   enforce_private_link_endpoint_network_policies = true
   enforce_private_link_service_network_policies  = true

templates/workspaces/base/terraform/storage.tf

@@ -6,11 +6,15 @@ resource "azurerm_storage_account" "stg" {
   account_replication_type = "GRS"
 
   lifecycle { ignore_changes = [tags] }
+}
 
-  network_rules {
-    bypass         = ["AzureServices"]
-    default_action = "Deny"
-  }
+resource "azurerm_storage_account_network_rules" "stgrules" {
+  resource_group_name  = azurerm_resource_group.ws.name
+  storage_account_name = azurerm_storage_account.stg.name
+
+  default_action             = "Deny"
+  virtual_network_subnet_ids = [azurerm_subnet.services.id]
+  bypass                     = ["AzureServices"]
 }
 
 resource "azurerm_private_endpoint" "stgfilepe" {