Is there a way in Azurerm to provision a subnet with an NSG attachment and also provision service endpoints as well . This is considering we have a policy to enforce NSG on
