diff --git a/CHANGELOG.md b/CHANGELOG.md
index a3ea27a0ac..4222702517 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -73,6 +73,8 @@ BUG FIXES:
 * Windows R version must be 4.1.2 otherwise post install script doesn't update package mirror URL ([#4288](https://github.com/microsoft/AzureTRE/issues/4288))
 * Recreate tre_output.json if empty. ([[#4292](https://github.com/microsoft/AzureTRE/issues/4292)])
 * Ensure R directory is present before attempting to update package mirror URL ([#4332](https://github.com/microsoft/AzureTRE/pull/4332))
+* Upgrade AzureRM Terraform provider from `3.117.0` to `4.14.0`. ([[PR_link](https://github.com/microsoft/AzureTRE/pull/4255/)])
+* Subnet definitions are now inline in the `azurerm_virtual_network` resource, and NSG associations are set using `security_group` in each subnet block (no separate `azurerm_subnet_network_security_group_association` needed). ([[PR_link](https://github.com/microsoft/AzureTRE/pull/4255/)])
 
 COMPONENTS:
 
diff --git a/core/terraform/.terraform.lock.hcl b/core/terraform/.terraform.lock.hcl
index 1c20359910..41d8da1a19 100644
--- a/core/terraform/.terraform.lock.hcl
+++ b/core/terraform/.terraform.lock.hcl
@@ -6,7 +6,6 @@ provider "registry.terraform.io/azure/azapi" {
   constraints = ">= 1.15.0, ~> 1.15.0"
   hashes = [
     "h1:Y7ruMuPh8UJRTRl4rm+cdpGtmURx2taqiuqfYaH3o48=",
-    "h1:gIOgxVmFSxHrR+XOzgUEA+ybOmp8kxZlZH3eYeB/eFI=",
     "zh:0627a8bc77254debc25dc0c7b62e055138217c97b03221e593c3c56dc7550671",
     "zh:2fe045f07070ef75d0bec4b0595a74c14394daa838ddb964e2fd23cc98c40c34",
     "zh:343009f39c957883b2c06145a5954e524c70f93585f943f1ea3d28ef6995d0d0",
@@ -23,22 +22,22 @@ provider "registry.terraform.io/azure/azapi" {
 }
 
 provider "registry.terraform.io/hashicorp/azurerm" {
-  version     = "3.117.0"
-  constraints = ">= 3.117.0, 3.117.0"
+  version     = "4.14.0"
+  constraints = ">= 3.117.0, 4.14.0"
   hashes = [
-    "h1:Ynfg+Iy7x6K8M6W1AhqXCe3wkoiqIQhROlca7C3KC3w=",
-    "zh:2e25f47492366821a786762369f0e0921cc9452d64bfd5075f6fdfcf1a9c6d70",
-    "zh:41eb34f2f7469bf3eb1019dfb0e7fc28256f809824016f4f8b9d691bf473b2ac",
-    "zh:48bb9c87b3d928da1abc1d3db75453c9725de4674c612daf3800160cc7145d30",
-    "zh:5d6b0de0bbd78943fcc65c53944ef4496329e247f434c6eab86ed051c5cea67b",
-    "zh:78c9f6fdb1206a89cf0e6706b4f46178169a93b6c964a4cad8a321058ccbd9b4",
-    "zh:793b702c352589d4360b580d4a1cf654a7439d2ad6bdb7bfea91de07bc4b0fac",
-    "zh:7ed687ff0a5509463a592f97431863574fe5cc80a34e395be06766215b8c6285",
-    "zh:955ba18789bd15592824eb426a8d0f38595bd09fffc6939c1c58933489c1a71e",
-    "zh:bf5949a55be0714cd9c8815d472eae4baa48ba06d0f6bf2b96775869acda8a54",
-    "zh:da5d31f635abd2c645ffc76d6176d73f646128e73720cc368247cc424975c127",
-    "zh:eed5a66d59883c9c56729b0a964a2b60d758ea7489ef3e920a6fbd48518ce5f5",
+    "h1:FYZ9qh8i3X2gDmUTe1jJ/VzdSyjGjVmhBzv2R8D6CBo=",
+    "zh:05aaea16fc5f27b14d9fbad81654edf0638949ed3585576b2219c76a2bee095a",
+    "zh:065ce6ed16ba3fa7efcf77888ea582aead54e6a28f184c6701b73d71edd64bb0",
+    "zh:3c0cd17c249d18aa2e0120acb5f0c14810725158b379a67fec1331110e7c50df",
+    "zh:5a3ba3ffb2f1ce519fe3bf84a7296aa5862c437c70c62f0b0a5293bea9f2d01c",
+    "zh:7a8e9d72fa2714f4d567270b1761d4b4e788de7c15dada7db0cf0e29933185a2",
+    "zh:a11e190073f31c1238c15af29b9162e0f4564f6b0cd0310a3fa94102738450dc",
+    "zh:a5c004114410cc6dcb8fed584c9f3b84283b58025b0073a7e88d2bdb27840dfa",
+    "zh:a674a41db118e244eda7591e455d2ec338626664e0856e4125e909eb038f78db",
+    "zh:b5139010e4cbb2cb1a27c775610593c1c8063d3a7c82b00a65006509c434df2f",
+    "zh:cbb031223ccd8b099ac4d19b92641142f330b90f2fc6452843e445bae28f832c",
     "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+    "zh:f7e7db1b94082a4ac3d4af3dabe7bbd335e1679305bf8e29d011f0ee440724ca",
   ]
 }
 
diff --git a/core/terraform/cosmos_mongo.tf b/core/terraform/cosmos_mongo.tf
index 65812cc8f1..6bb4ec4594 100644
--- a/core/terraform/cosmos_mongo.tf
+++ b/core/terraform/cosmos_mongo.tf
@@ -6,7 +6,7 @@ resource "azurerm_cosmosdb_account" "mongo" {
   kind                       = "MongoDB"
   automatic_failover_enabled = false
   mongo_server_version       = 4.2
-  ip_range_filter            = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
+  ip_range_filter            = local.cosmos_ip_filter_set
 
   capabilities {
     name = "EnableServerless"
diff --git a/core/terraform/locals.tf b/core/terraform/locals.tf
index 22d327f96f..15f066ae7b 100644
--- a/core/terraform/locals.tf
+++ b/core/terraform/locals.tf
@@ -14,7 +14,20 @@ locals {
   docker_registry_server = data.azurerm_container_registry.mgmt_acr.login_server
 
   # https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-firewall#allow-requests-from-the-azure-portal
-  azure_portal_cosmos_ips = "104.42.195.92,40.76.54.131,52.176.6.30,52.169.50.45,52.187.184.26"
+
+  azure_portal_cosmos_ips_list = [
+    "104.42.195.92",
+    "40.76.54.131",
+    "52.176.6.30",
+    "52.169.50.45",
+    "52.187.184.26"
+  ]
+
+  cosmos_ip_filter_set = toset(
+    var.enable_local_debugging
+    ? concat(local.azure_portal_cosmos_ips_list, [local.myip])
+    : local.azure_portal_cosmos_ips_list
+  )
 
   # we define some zones in core despite not used by the core infra because
   # it's the easier way to make them available to other services in the system.
diff --git a/core/terraform/main.tf b/core/terraform/main.tf
index 4d6d910257..b231621603 100644
--- a/core/terraform/main.tf
+++ b/core/terraform/main.tf
@@ -3,7 +3,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "=3.117.0"
+      version = "=4.14.0"
     }
     random = {
       source  = "hashicorp/random"
diff --git a/core/terraform/migrate.sh b/core/terraform/migrate.sh
index 02dde4364a..5f64abeb15 100755
--- a/core/terraform/migrate.sh
+++ b/core/terraform/migrate.sh
@@ -5,16 +5,25 @@ set -o pipefail
 set -o nounset
 # set -o xtrace
 
-# Configure AzureRM provider to user Azure AD to connect to storage accounts
+get_resource_id() {
+  local json_data="$1"
+  local resource_addr="$2"
+  echo "$json_data" | jq -r --arg addr "$resource_addr" '
+    def walk_resources:
+      (.resources[]?),
+      (.child_modules[]? | walk_resources);
+    .values.root_module | walk_resources | select(.address==$addr) | .values.id
+  '
+}
+
+# Configure AzureRM provider to use Azure AD to connect to storage accounts
 export ARM_STORAGE_USE_AZUREAD=true
 
-# Configure AzureRM backend to user Azure AD to connect to storage accounts
+# Configure AzureRM backend to use Azure AD to connect to storage accounts
 export ARM_USE_AZUREAD=true
 export ARM_USE_OIDC=true
 
-# terraform_wrapper_path="../../devops/scripts/terraform_wrapper.sh"
-
-# This variables are loaded in for us
+# These variables are loaded in for us
 # shellcheck disable=SC2154
 terraform init -input=false -backend=true -reconfigure \
     -backend-config="resource_group_name=${TF_VAR_mgmt_resource_group_name}" \
@@ -24,42 +33,68 @@ terraform init -input=false -backend=true -reconfigure \
 
 echo "*** Migrating TF Resources... ***"
 
+terraform refresh
 
+# get TF state in JSON
 terraform_show_json=$(terraform show -json)
 
-# Remove cnab-state legacy state path form state. Needs to be run before refresh, as refresh will fail.
-state_store_legacy_path=$(echo "${terraform_show_json}" \
-   | jq 'select(.values.root_module.resources != null) | .values.root_module.resources[] | select(.address=="azurerm_storage_share.storage_state_path") | .values.id')
-
-if [ -n "${state_store_legacy_path}" ]; then
-  echo -e "\n\e[96mRemoving legacy state path from TF state\e[0m..."
-  terraform state rm azurerm_storage_share.storage_state_path
-fi
-
-# terraform show might fail if provider schema has changed. Since we don't call apply at this stage a refresh is needed
-terraform refresh
+# List of resource addresses to remove.
+declare -a RESOURCES_TO_REMOVE=(
+  "module.network.azurerm_subnet_network_security_group_association.bastion"
+  "module.network.azurerm_subnet_network_security_group_association.app_gw"
+  "module.network.azurerm_subnet_network_security_group_association.shared"
+  "module.network.azurerm_subnet_network_security_group_association.web_app"
+  "module.network.azurerm_subnet_network_security_group_association.resource_processor"
+  "module.network.azurerm_subnet_network_security_group_association.airlock_processor"
+  "module.network.azurerm_subnet_network_security_group_association.airlock_notification"
+  "module.network.azurerm_subnet_network_security_group_association.airlock_storage"
+  "module.network.azurerm_subnet_network_security_group_association.airlock_events"
+  "module.network.azurerm_subnet.bastion"
+  "module.network.azurerm_subnet.azure_firewall"
+  "module.network.azurerm_subnet.app_gw"
+  "module.network.azurerm_subnet.web_app"
+  "module.network.azurerm_subnet.shared"
+  "module.network.azurerm_subnet.resource_processor"
+  "module.network.azurerm_subnet.airlock_processor"
+  "module.network.azurerm_subnet.airlock_notification"
+  "module.network.azurerm_subnet.airlock_storage"
+  "module.network.azurerm_subnet.airlock_events"
+  "module.network.azurerm_subnet.firewall_management"
+)
+vnet_address="module.network.azurerm_virtual_network.core"
 
-# 1. Check we have a root_module in state
-# 2. Grab the Resource ID
-# 3. Delete the old resource from state
-# 4. Import the new resource type in using the existing Azure Resource ID
+# Check if migration is needed
+migration_needed=0
+for resource in "${RESOURCES_TO_REMOVE[@]}"; do
+  resource_id=$(get_resource_id "${terraform_show_json}" "$resource")
+  if [ -n "$resource_id" ] && [ "$resource_id" != "null" ]; then
+    migration_needed=1
+    break
+  fi
+done
 
-terraform_show_json=$(terraform show -json)
+# Remove old resources
+if [ "$migration_needed" -eq 1 ]; then
+  for resource in "${RESOURCES_TO_REMOVE[@]}"; do
+    resource_id=$(get_resource_id "${terraform_show_json}" "$resource")
+    if [ -n "$resource_id" ] && [ "$resource_id" != "null" ]; then
+      terraform state rm "$resource"
+    else
+      echo "Resource that was supposed to be removed not found in state: ${resource}"
+    fi
+  done
 
-# example migration
-# # azurerm_app_service_plan -> azurerm_service_plan
-# core_app_service_plan_id=$(echo "${terraform_show_json}" \
-#   | jq -r 'select(.values.root_module.resources != null) | .values.root_module.resources[] | select(.address=="azurerm_app_service_plan.core") | .values.id')
-# if [ -n "${core_app_service_plan_id}" ]; then
-#   echo "Migrating ${core_app_service_plan_id}"
-#   terraform state rm azurerm_app_service_plan.core
-#   if [[ $(az resource list --query "[?id=='${core_app_service_plan_id}'] | length(@)") == 0 ]];
-#   then
-#     echo "The resource doesn't exist on Azure. Skipping importing it back to state."
-#   else
-#     terraform import azurerm_service_plan.core "${core_app_service_plan_id}"
-#   fi
-# fi
-
-echo "*** Migration is done. ***"
-# check if main is that issue
+  # Remove and re-import the VNet
+  vnet_address="module.network.azurerm_virtual_network.core"
+  vnet_id=$(get_resource_id "${terraform_show_json}" "$vnet_address" "vnet")
+  if [ -n "${vnet_id}" ] && [ "${vnet_id}" != "null" ]; then
+    terraform state rm "${vnet_address}"
+    terraform import "${vnet_address}" "${vnet_id}"
+  else
+    echo "VNet resource not found in state: ${vnet_address}"
+  fi
+  echo "*** Migration Done ***"
+else
+  echo "No old resources found in the state, skipping migration."
+  echo "*** Migration Skipped ***"
+fi
diff --git a/core/terraform/network/.terraform.lock.hcl b/core/terraform/network/.terraform.lock.hcl
new file mode 100644
index 0000000000..ec690305f6
--- /dev/null
+++ b/core/terraform/network/.terraform.lock.hcl
@@ -0,0 +1,22 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/azurerm" {
+  version     = "4.14.0"
+  constraints = "4.14.0"
+  hashes = [
+    "h1:FYZ9qh8i3X2gDmUTe1jJ/VzdSyjGjVmhBzv2R8D6CBo=",
+    "zh:05aaea16fc5f27b14d9fbad81654edf0638949ed3585576b2219c76a2bee095a",
+    "zh:065ce6ed16ba3fa7efcf77888ea582aead54e6a28f184c6701b73d71edd64bb0",
+    "zh:3c0cd17c249d18aa2e0120acb5f0c14810725158b379a67fec1331110e7c50df",
+    "zh:5a3ba3ffb2f1ce519fe3bf84a7296aa5862c437c70c62f0b0a5293bea9f2d01c",
+    "zh:7a8e9d72fa2714f4d567270b1761d4b4e788de7c15dada7db0cf0e29933185a2",
+    "zh:a11e190073f31c1238c15af29b9162e0f4564f6b0cd0310a3fa94102738450dc",
+    "zh:a5c004114410cc6dcb8fed584c9f3b84283b58025b0073a7e88d2bdb27840dfa",
+    "zh:a674a41db118e244eda7591e455d2ec338626664e0856e4125e909eb038f78db",
+    "zh:b5139010e4cbb2cb1a27c775610593c1c8063d3a7c82b00a65006509c434df2f",
+    "zh:cbb031223ccd8b099ac4d19b92641142f330b90f2fc6452843e445bae28f832c",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+    "zh:f7e7db1b94082a4ac3d4af3dabe7bbd335e1679305bf8e29d011f0ee440724ca",
+  ]
+}
diff --git a/core/terraform/network/locals.tf b/core/terraform/network/locals.tf
index aaa2aea7d1..b09deb16e1 100644
--- a/core/terraform/network/locals.tf
+++ b/core/terraform/network/locals.tf
@@ -32,4 +32,6 @@ locals {
     "privatelink.queue.core.windows.net",
     "privatelink.table.core.windows.net"
   ])
+
+  subnet_ids_map = { for s in azurerm_virtual_network.core.subnet : s.name => s.id }
 }
diff --git a/core/terraform/network/main.tf b/core/terraform/network/main.tf
index a4eb095f9c..5cced47bb0 100644
--- a/core/terraform/network/main.tf
+++ b/core/terraform/network/main.tf
@@ -3,7 +3,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = ">= 3.117"
+      version = ">= 4.14.0"
     }
   }
 }
diff --git a/core/terraform/network/network.tf b/core/terraform/network/network.tf
index db71fe554f..a511365326 100644
--- a/core/terraform/network/network.tf
+++ b/core/terraform/network/network.tf
@@ -5,146 +5,112 @@ resource "azurerm_virtual_network" "core" {
   address_space       = [var.core_address_space]
   tags                = local.tre_core_tags
   lifecycle { ignore_changes = [tags] }
-}
 
-resource "azurerm_subnet" "bastion" {
-  name                 = "AzureBastionSubnet"
-  virtual_network_name = azurerm_virtual_network.core.name
-  resource_group_name  = var.resource_group_name
-  address_prefixes     = [local.bastion_subnet_address_prefix]
-}
+  subnet {
+    name             = "AzureBastionSubnet"
+    address_prefixes = [local.bastion_subnet_address_prefix]
+    security_group   = azurerm_network_security_group.bastion.id
+  }
 
-resource "azurerm_subnet" "azure_firewall" {
-  name                 = "AzureFirewallSubnet"
-  virtual_network_name = azurerm_virtual_network.core.name
-  resource_group_name  = var.resource_group_name
-  address_prefixes     = [local.firewall_subnet_address_space]
-  depends_on           = [azurerm_subnet.bastion]
-}
+  subnet {
+    name             = "AzureFirewallSubnet"
+    address_prefixes = [local.firewall_subnet_address_space]
+  }
 
-resource "azurerm_subnet" "app_gw" {
-  name                                          = "AppGwSubnet"
-  virtual_network_name                          = azurerm_virtual_network.core.name
-  resource_group_name                           = var.resource_group_name
-  address_prefixes                              = [local.app_gw_subnet_address_prefix]
-  private_endpoint_network_policies             = "Disabled"
-  private_link_service_network_policies_enabled = true
-  depends_on                                    = [azurerm_subnet.azure_firewall]
-}
+  subnet {
+    name                                          = "AppGwSubnet"
+    address_prefixes                              = [local.app_gw_subnet_address_prefix]
+    private_endpoint_network_policies             = "Disabled"
+    private_link_service_network_policies_enabled = true
+    security_group                                = azurerm_network_security_group.app_gw.id
+  }
 
-resource "azurerm_subnet" "web_app" {
-  name                                          = "WebAppSubnet"
-  virtual_network_name                          = azurerm_virtual_network.core.name
-  resource_group_name                           = var.resource_group_name
-  address_prefixes                              = [local.web_app_subnet_address_prefix]
-  private_endpoint_network_policies             = "Disabled"
-  private_link_service_network_policies_enabled = true
-  depends_on                                    = [azurerm_subnet.app_gw]
-
-  delegation {
-    name = "delegation"
-
-    service_delegation {
-      name    = "Microsoft.Web/serverFarms"
-      actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
+  subnet {
+    name                                          = "WebAppSubnet"
+    address_prefixes                              = [local.web_app_subnet_address_prefix]
+    private_endpoint_network_policies             = "Disabled"
+    private_link_service_network_policies_enabled = true
+    security_group                                = azurerm_network_security_group.default_rules.id
+
+    delegation {
+      name = "delegation"
+
+      service_delegation {
+        name    = "Microsoft.Web/serverFarms"
+        actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
+      }
     }
   }
-}
 
-resource "azurerm_subnet" "shared" {
-  name                 = "SharedSubnet"
-  virtual_network_name = azurerm_virtual_network.core.name
-  resource_group_name  = var.resource_group_name
-  address_prefixes     = [local.shared_services_subnet_address_prefix]
-  # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies = "Disabled"
-  depends_on                        = [azurerm_subnet.web_app]
-}
+  subnet {
+    name                              = "SharedSubnet"
+    address_prefixes                  = [local.shared_services_subnet_address_prefix]
+    private_endpoint_network_policies = "Disabled"
+    security_group                    = azurerm_network_security_group.default_rules.id
+  }
 
-resource "azurerm_subnet" "resource_processor" {
-  name                 = "ResourceProcessorSubnet"
-  virtual_network_name = azurerm_virtual_network.core.name
-  resource_group_name  = var.resource_group_name
-  address_prefixes     = [local.resource_processor_subnet_address_prefix]
-  # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies = "Disabled"
-  depends_on                        = [azurerm_subnet.shared]
-}
+  subnet {
+    name                              = "ResourceProcessorSubnet"
+    address_prefixes                  = [local.resource_processor_subnet_address_prefix]
+    private_endpoint_network_policies = "Disabled"
+    security_group                    = azurerm_network_security_group.default_rules.id
+  }
+
+  subnet {
+    name                              = "AirlockProcessorSubnet"
+    address_prefixes                  = [local.airlock_processor_subnet_address_prefix]
+    private_endpoint_network_policies = "Disabled"
+    security_group                    = azurerm_network_security_group.default_rules.id
 
-resource "azurerm_subnet" "airlock_processor" {
-  name                 = "AirlockProcessorSubnet"
-  virtual_network_name = azurerm_virtual_network.core.name
-  resource_group_name  = var.resource_group_name
-  address_prefixes     = [local.airlock_processor_subnet_address_prefix]
-  # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies = "Disabled"
-  depends_on                        = [azurerm_subnet.resource_processor]
-
-  delegation {
-    name = "delegation"
-
-    service_delegation {
-      name    = "Microsoft.Web/serverFarms"
-      actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
+    delegation {
+      name = "delegation"
+
+      service_delegation {
+        name    = "Microsoft.Web/serverFarms"
+        actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
+      }
     }
+
+    service_endpoints = ["Microsoft.Storage"]
   }
 
-  # Todo: needed as we want to open the fw for this subnet in some of the airlock storages (export inprogress)
-  # https://github.com/microsoft/AzureTRE/issues/2098
-  service_endpoints = ["Microsoft.Storage"]
-}
+  subnet {
+    name                              = "AirlockNotifiactionSubnet"
+    address_prefixes                  = [local.airlock_notifications_subnet_address_prefix]
+    private_endpoint_network_policies = "Disabled"
+    security_group                    = azurerm_network_security_group.default_rules.id
+
+    delegation {
+      name = "delegation"
 
-resource "azurerm_subnet" "airlock_notification" {
-  name                 = "AirlockNotifiactionSubnet"
-  virtual_network_name = azurerm_virtual_network.core.name
-  resource_group_name  = var.resource_group_name
-  address_prefixes     = [local.airlock_notifications_subnet_address_prefix]
-  # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies = "Disabled"
-  depends_on                        = [azurerm_subnet.airlock_processor]
-
-  delegation {
-    name = "delegation"
-
-    service_delegation {
-      name    = "Microsoft.Web/serverFarms"
-      actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
+      service_delegation {
+        name    = "Microsoft.Web/serverFarms"
+        actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
+      }
     }
+    service_endpoints = ["Microsoft.ServiceBus"]
   }
-  service_endpoints = ["Microsoft.ServiceBus"]
-}
 
-resource "azurerm_subnet" "airlock_storage" {
-  name                 = "AirlockStorageSubnet"
-  virtual_network_name = azurerm_virtual_network.core.name
-  resource_group_name  = var.resource_group_name
-  address_prefixes     = [local.airlock_storage_subnet_address_prefix]
-  # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies = "Disabled"
-  depends_on                        = [azurerm_subnet.airlock_notification]
-}
+  subnet {
+    name                              = "AirlockStorageSubnet"
+    address_prefixes                  = [local.airlock_storage_subnet_address_prefix]
+    private_endpoint_network_policies = "Disabled"
+    security_group                    = azurerm_network_security_group.default_rules.id
+  }
 
-resource "azurerm_subnet" "airlock_events" {
-  name                 = "AirlockEventsSubnet"
-  virtual_network_name = azurerm_virtual_network.core.name
-  resource_group_name  = var.resource_group_name
-  address_prefixes     = [local.airlock_events_subnet_address_prefix]
-  # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies = "Disabled"
-  depends_on                        = [azurerm_subnet.airlock_storage]
-
-  # Eventgrid CAN'T send messages over private endpoints, hence we need to allow service endpoints to the service bus
-  # We are using service endpoints + managed identity to send these messaages
-  # https://docs.microsoft.com/en-us/azure/event-grid/consume-private-endpoints
-  service_endpoints = ["Microsoft.ServiceBus"]
-}
+  subnet {
+    name                              = "AirlockEventsSubnet"
+    address_prefixes                  = [local.airlock_events_subnet_address_prefix]
+    private_endpoint_network_policies = "Disabled"
+    security_group                    = azurerm_network_security_group.default_rules.id
 
-resource "azurerm_subnet" "firewall_management" {
-  name                 = "AzureFirewallManagementSubnet"
-  virtual_network_name = azurerm_virtual_network.core.name
-  resource_group_name  = var.resource_group_name
-  address_prefixes     = [local.firewall_management_subnet_address_prefix]
-  depends_on           = [azurerm_subnet.airlock_events]
+    service_endpoints = ["Microsoft.ServiceBus"]
+  }
+
+  subnet {
+    name             = "AzureFirewallManagementSubnet"
+    address_prefixes = [local.firewall_management_subnet_address_prefix]
+  }
 }
 
 resource "azurerm_ip_group" "resource_processor" {
diff --git a/core/terraform/network/network_security_groups.tf b/core/terraform/network/network_security_groups.tf
index 50accf846b..34371dc145 100644
--- a/core/terraform/network/network_security_groups.tf
+++ b/core/terraform/network/network_security_groups.tf
@@ -105,13 +105,6 @@ resource "azurerm_network_security_group" "bastion" {
   lifecycle { ignore_changes = [tags] }
 }
 
-resource "azurerm_subnet_network_security_group_association" "bastion" {
-  subnet_id                 = azurerm_subnet.bastion.id
-  network_security_group_id = azurerm_network_security_group.bastion.id
-  # depend on the last subnet we created in the vnet
-  depends_on = [azurerm_subnet.firewall_management]
-}
-
 # Network security group for Application Gateway
 # See https://docs.microsoft.com/azure/application-gateway/configuration-infrastructure#network-security-groups
 resource "azurerm_network_security_group" "app_gw" {
@@ -147,12 +140,6 @@ resource "azurerm_network_security_group" "app_gw" {
   lifecycle { ignore_changes = [tags] }
 }
 
-resource "azurerm_subnet_network_security_group_association" "app_gw" {
-  subnet_id                 = azurerm_subnet.app_gw.id
-  network_security_group_id = azurerm_network_security_group.app_gw.id
-  depends_on                = [azurerm_subnet_network_security_group_association.bastion]
-}
-
 # Network security group with only default security rules
 # See https://docs.microsoft.com/azure/virtual-network/network-security-groups-overview#default-security-rules
 resource "azurerm_network_security_group" "default_rules" {
@@ -163,45 +150,3 @@ resource "azurerm_network_security_group" "default_rules" {
 
   lifecycle { ignore_changes = [tags] }
 }
-
-resource "azurerm_subnet_network_security_group_association" "shared" {
-  subnet_id                 = azurerm_subnet.shared.id
-  network_security_group_id = azurerm_network_security_group.default_rules.id
-  depends_on                = [azurerm_subnet_network_security_group_association.app_gw]
-}
-
-resource "azurerm_subnet_network_security_group_association" "web_app" {
-  subnet_id                 = azurerm_subnet.web_app.id
-  network_security_group_id = azurerm_network_security_group.default_rules.id
-  depends_on                = [azurerm_subnet_network_security_group_association.shared]
-}
-
-resource "azurerm_subnet_network_security_group_association" "resource_processor" {
-  subnet_id                 = azurerm_subnet.resource_processor.id
-  network_security_group_id = azurerm_network_security_group.default_rules.id
-  depends_on                = [azurerm_subnet_network_security_group_association.web_app]
-}
-
-resource "azurerm_subnet_network_security_group_association" "airlock_processor" {
-  subnet_id                 = azurerm_subnet.airlock_processor.id
-  network_security_group_id = azurerm_network_security_group.default_rules.id
-  depends_on                = [azurerm_subnet_network_security_group_association.resource_processor]
-}
-
-resource "azurerm_subnet_network_security_group_association" "airlock_storage" {
-  subnet_id                 = azurerm_subnet.airlock_storage.id
-  network_security_group_id = azurerm_network_security_group.default_rules.id
-  depends_on                = [azurerm_subnet_network_security_group_association.airlock_processor]
-}
-
-resource "azurerm_subnet_network_security_group_association" "airlock_events" {
-  subnet_id                 = azurerm_subnet.airlock_events.id
-  network_security_group_id = azurerm_network_security_group.default_rules.id
-  depends_on                = [azurerm_subnet_network_security_group_association.airlock_storage]
-}
-
-resource "azurerm_subnet_network_security_group_association" "airlock_notification" {
-  subnet_id                 = azurerm_subnet.airlock_notification.id
-  network_security_group_id = azurerm_network_security_group.default_rules.id
-  depends_on                = [azurerm_subnet_network_security_group_association.airlock_events]
-}
diff --git a/core/terraform/network/outputs.tf b/core/terraform/network/outputs.tf
index 3e0aab407d..e2a7fba134 100644
--- a/core/terraform/network/outputs.tf
+++ b/core/terraform/network/outputs.tf
@@ -3,43 +3,43 @@ output "core_vnet_id" {
 }
 
 output "bastion_subnet_id" {
-  value = azurerm_subnet.bastion.id
+  value = local.subnet_ids_map["AzureBastionSubnet"]
 }
 
 output "azure_firewall_subnet_id" {
-  value = azurerm_subnet.azure_firewall.id
+  value = local.subnet_ids_map["AzureFirewallSubnet"]
 }
 
 output "app_gw_subnet_id" {
-  value = azurerm_subnet.app_gw.id
+  value = local.subnet_ids_map["AppGwSubnet"]
 }
 
 output "web_app_subnet_id" {
-  value = azurerm_subnet.web_app.id
+  value = local.subnet_ids_map["WebAppSubnet"]
 }
 
 output "shared_subnet_id" {
-  value = azurerm_subnet.shared.id
+  value = local.subnet_ids_map["SharedSubnet"]
 }
 
 output "airlock_processor_subnet_id" {
-  value = azurerm_subnet.airlock_processor.id
+  value = local.subnet_ids_map["AirlockProcessorSubnet"]
 }
 
 output "airlock_storage_subnet_id" {
-  value = azurerm_subnet.airlock_storage.id
+  value = local.subnet_ids_map["AirlockStorageSubnet"]
 }
 
 output "airlock_events_subnet_id" {
-  value = azurerm_subnet.airlock_events.id
+  value = local.subnet_ids_map["AirlockEventsSubnet"]
 }
 
 output "resource_processor_subnet_id" {
-  value = azurerm_subnet.resource_processor.id
+  value = local.subnet_ids_map["ResourceProcessorSubnet"]
 }
 
 output "airlock_notification_subnet_id" {
-  value = azurerm_subnet.airlock_notification.id
+  value = local.subnet_ids_map["AirlockNotifiactionSubnet"]
 }
 
 # DNS Zones
diff --git a/core/terraform/statestore.tf b/core/terraform/statestore.tf
index 66748fda58..3c9ee87b4c 100644
--- a/core/terraform/statestore.tf
+++ b/core/terraform/statestore.tf
@@ -1,11 +1,17 @@
 resource "azurerm_cosmosdb_account" "tre_db_account" {
-  name                          = "cosmos-${var.tre_id}"
-  location                      = azurerm_resource_group.core.location
-  resource_group_name           = azurerm_resource_group.core.name
-  offer_type                    = "Standard"
-  kind                          = "GlobalDocumentDB"
-  automatic_failover_enabled    = false
-  ip_range_filter               = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
+  name                       = "cosmos-${var.tre_id}"
+  location                   = azurerm_resource_group.core.location
+  resource_group_name        = azurerm_resource_group.core.name
+  offer_type                 = "Standard"
+  kind                       = "GlobalDocumentDB"
+  automatic_failover_enabled = false
+  ip_range_filter            = local.cosmos_ip_filter_set
+
+
+
+
+
+
   local_authentication_disabled = true
   tags                          = local.tre_core_tags
 
diff --git a/core/version.txt b/core/version.txt
index 836582489b..ea370a8e55 100644
--- a/core/version.txt
+++ b/core/version.txt
@@ -1 +1 @@
-__version__ = "0.11.23"
+__version__ = "0.12.0"